{"id":"CVE-2024-35811","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brc…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brc…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.7, < 4.19.312","linux_kernel >= 4.20, < 5.4.274","linux_kernel >= 5.5, < 5.10.215","linux_kernel >= 5.11, < 5.15.154","linux_kernel >= 5.16, < 6.1.84","linux_kernel >= 6.2, < 6.6.24","linux_kernel >= 6.7, < 6.7.12","linux_kernel >= 6.8, < 6.8.3","debian_linux = 10.0"],"patched":["linux_kernel 6.8.3"],"published":"2024-05-17","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:47.423","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-35811","references":[{"url":"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35811.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-35811"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2281213"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35811"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35811"},{"url":"https://lore.kernel.org/linux-cve-announce/2024051741-CVE-2024-35811-9306@gregkh/T"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00353,"epssPercentile":0.288,"ingestedAt":"2026-10-15T03:30:12.680Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T15:42:35.275433Z"},"scores":{"nvd":8.8,"vendor":5.5},"slug":"CVE-2024-35811","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n->brcmf_usb_probe\n  ->brcmf_usb_probe_cb\n    ->brcmf_attach\n      ->brcmf_bus_started\n        ->brcmf_cfg80211_attach\n          ->wl_init_priv\n            ->brcmf_init_escan\n              ->INIT_WORK(&cfg->escan_timeout_work,\n\t\t  brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n  ->brcmf_usb_disconnect_cb\n    ->brcmf_detach\n      ->brcmf_cfg80211_detach\n        ->kfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]\n\n## Affected\n\n- `linux_kernel >= 3.7, < 4.19.312`\n- `linux_kernel >= 4.20, < 5.4.274`\n- `linux_kernel >= 5.5, < 5.10.215`\n- `linux_kernel >= 5.11, < 5.15.154`\n- `linux_kernel >= 5.16, < 6.1.84`\n- `linux_kernel >= 6.2, < 6.6.24`\n- `linux_kernel >= 6.7, < 6.7.12`\n- `linux_kernel >= 6.8, < 6.8.3`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.8.3`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35811.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}