---
id: CVE-2024-53189
title: 'wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

  The channels array in the cfg80211_scan_request has a __counted_by
  attribute attached to it, which …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 <
    d4ef643ea78c59c22546046c25dc6e7206267672
  - >-
    Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 <
    1a7b62ddf2c7642878c24f0e556041bb58c37527
  - >-
    Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 <
    9c46a3a5b394d6d123866aa44436fc2cd342eb0d
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:28:12.458162Z'
published: '2024-12-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:22.763Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53189'
references:
  - url: 'https://git.kernel.org/stable/c/d4ef643ea78c59c22546046c25dc6e7206267672'
  - url: 'https://git.kernel.org/stable/c/1a7b62ddf2c7642878c24f0e556041bb58c37527'
  - url: 'https://git.kernel.org/stable/c/9c46a3a5b394d6d123866aa44436fc2cd342eb0d'
tags:
  - cve.org
epss: 0.0023
epssPercentile: 0.13907
ingestedAt: '2026-11-05T22:38:31.830Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

The channels array in the cfg80211_scan_request has a __counted_by
attribute attached to it, which points to the n_channels variable. This
attribute is used in bounds checking, and if it is not set before the
array is filled, then the bounds sanitizer will issue a warning or a
kernel panic if CONFIG_UBSAN_TRAP is set.

This patch sets the size of allocated memory as the initial value for
n_channels. It is updated with the actual number of added elements after
the array is filled.

## Affected

- `Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 < d4ef643ea78c59c22546046c25dc6e7206267672`
- `Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 < 1a7b62ddf2c7642878c24f0e556041bb58c37527`
- `Linux >= aa4ec06c455d0200eea0a4361cc58eb5b8bf68c4 < 9c46a3a5b394d6d123866aa44436fc2cd342eb0d`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.