CVE-2024-47715

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: fix oops on non-dbdc mt7986

mt7915_band_config() sets band_idx = 1 on the main phy for mt7986

with MT7975_ONE_ADIE or MT7976_ONE_ADIE.

Commit 0335c034e726 ("wifi: mt76: fix race condition related to

checking tx queue fill status") introduced a dereference of the

phys array indirectly indexed by band_idx via wcid->phy_idx in

mt76_wcid_cleanup(). This caused the following Oops on affected

mt7986 devices:

Unable to handle kernel read from unreadable memory at virtual address 0000000000000024

Mem abort info:

ESR = 0x0000000096000005

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x05: level 1 translation fault

Data abort info:

ISV = 0, ISS = 0x00000005

CM = 0, WnR = 0

user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000

[0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000

Internal error: Oops: 0000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References