Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Linux kernel Wi‑Fi driver can crash or be abused

CVE-2021-47017 · published 2 years ago
Summary

The ath10k Wi‑Fi driver in the Linux kernel may free a piece of memory and then try to use it later, which can cause the system to crash or be taken over by an attacker. This occurs when the driver processes certain network data. Apply the latest kernel updates from your Linux distribution to get the fix.

What to do
  • Update debian linux to version 5.10.38-1.
  • Update linux linux to version 8bb054fb336f4250002fff4e0b075221c05c3c65 or later.
Affected software
Ecosystem VendorProductAffected versions
– linux linux < 8bb054fb336f4250002fff4e0b075221c05c3c65
5.8
– linux linux_kernel >= 5.8, < 5.10.37
>= 5.11, < 5.11.21
>= 5.12, < 5.12.4
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Debian:12 debian linux < 5.10.38-1
Fix: upgrade to 5.10.38-1
Original advisory text
ath10k: Fix a use after free in ath10k_htc_send_bundle
In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published28 Feb 2024
Updated4 Nov 2026
First seen4 Aug 2026
Sources
CVE-2021-47017 · NVD
CVE-2021-47017 · MITRE
DEBIAN-CVE-2021-47017 · OSV
Track software like this
Free during beta