---
id: CVE-2024-56609
title: 'wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb

  When removing kernel modules by:
     rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core

  Drive…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 <
    4e8ce3978d704cb28678355d294e10a008b6230a
  - >-
    Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 <
    3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68
  - >-
    Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 <
    9bca6528f20325d30c22236b23116f161d418f6d
  - >-
    Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 <
    3e5e4a801aaf4283390cc34959c6c48f910ca5ea
  - Linux 5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:29:17.448515Z'
published: '2024-12-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:25.055Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-56609'
references:
  - url: 'https://git.kernel.org/stable/c/4e8ce3978d704cb28678355d294e10a008b6230a'
  - url: 'https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68'
  - url: 'https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d'
  - url: 'https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea'
tags:
  - cve.org
epss: 0.00227
epssPercentile: 0.13468
ingestedAt: '2026-11-05T22:38:31.834Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb

When removing kernel modules by:
   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core

Driver uses skb_queue_purge() to purge TX skb, but not report tx status
causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue()
to correct this.

Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing
between TX work and purge TX queue, flush and destroy TX work in advance.

   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
     choice (Reason: 3=DEAUTH_LEAVING)
   ------------[ cut here ]------------
   Have pending ack frames!
   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C
       6.10.1-200.fc40.aarch64 #1
   Hardware name: pine64 Pine64 PinePhone Braveheart
      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
   sp : ffff80008c1b37b0
   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
   Call trace:
    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
    idr_for_each+0x74/0x110
    ieee80211_free_hw+0x44/0xe8 [mac80211]
    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
    sdio_bus_remove+0x44/0x180
    device_remove+0x54/0x90
    device_release_driver_internal+0x1d4/0x238
    driver_detach+0x54/0xc0
    bus_remove_driver+0x78/0x108
    driver_unregister+0x38/0x78
    sdio_unregister_driver+0x2c/0x40
    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
    __do_sys_delete_module.isra.0+0x190/0x338
    __arm64_sys_delete_module+0x1c/0x30
    invoke_syscall+0x74/0x100
    el0_svc_common.constprop.0+0x48/0xf0
    do_el0_svc+0x24/0x38
    el0_svc+0x3c/0x158
    el0t_64_sync_handler+0x120/0x138
    el0t_64_sync+0x194/0x198
   ---[ end trace 0000000000000000 ]---

## Affected

- `Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 < 4e8ce3978d704cb28678355d294e10a008b6230a`
- `Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 < 3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68`
- `Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 < 9bca6528f20325d30c22236b23116f161d418f6d`
- `Linux >= e3037485c68ec1a299ff41160d8fedbd4abc29b9 < 3e5e4a801aaf4283390cc34959c6c48f910ca5ea`
- `Linux 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.