What is the CVSS score of CVE-2024-26666?

CVE-2024-26666 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-26666?

A high-severity vulnerability in Linux kernel Wi-Fi functionality (CVE-2024-26666) could allow attackers with network proximity to leak kernel memory or disrupt service availability.. A patch is available.

How to fix or mitigate CVE-2024-26666?

Within 24 hours, inventory all Linux systems with Wi-Fi capability and TDLS support in your environment, prioritizing data centers, enterprise endpoints, and remote infrastructure. Within 7 days, contact your Linux distribution vendor (Red Hat, Ubuntu, SUSE, Debian) or kernel maintainers for the patched kernel version, test it in non-production environments matching your production configuration, and create a phased deployment plan. Within 30 days, deploy the patched kernel across all affected systems, reboot as required, and validate Wi-Fi service stability and kernel version compliance.

Linux Kernel CVE-2024-26666

HIGH

2024-04-02 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.1

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.1 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

vuln.today AI

7.1 HIGH

Adjacent vector confirmed by TDLS Wi-Fi scope; AC:H reflects kernel race condition timing requirement; PR:N as no authentication to target system is required.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:48 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:47 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

7.8 (HIGH) 7.1 (HIGH)

CVE Published

Apr 02, 2024 - 07:15 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix RCU use in TDLS fast-xmit

This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that.

AnalysisAI

Improper RCU (Read-Copy-Update) synchronization in the Linux kernel's mac80211 Wi-Fi subsystem TDLS fast-xmit path allows an adjacent-network attacker to exploit a race condition, potentially disclosing kernel memory or causing a denial of service. The vulnerability arises because a link lookup occurs under an assumed RCU read-lock that is not guaranteed to be held at that point in execution, enabling use-after-free or invalid memory access. No public exploit has been identified and EPSS is very low at 0.23%, but the CVSS score of 7.1 (High) reflects meaningful confidentiality and availability impact if exploitation conditions are met.

Technical ContextAI

The vulnerability resides in the mac80211 subsystem (kernel/net/mac80211), which is the IEEE 802.11 (Wi-Fi) stack for the Linux kernel. The specific code path involves TDLS (Tunneled Direct Link Setup) fast-xmit, a mechanism enabling direct client-to-client data forwarding without routing through an access point. RCU (Read-Copy-Update) is a Linux kernel synchronization primitive: code reading shared data structures must hold an RCU read lock to prevent the writer from reclaiming memory while the reader is active. The defect is that the code performs a link structure lookup assuming RCU protection is in effect, but there is no guaranteed RCU read lock held at that execution point. This creates a race window where the underlying memory may be freed by another CPU core while the lookup is in progress, leading to a use-after-free condition. The CWE classification is not specified in the input, but the root cause class is consistent with CWE-362 (Race Condition) and CWE-416 (Use After Free). Affected CPEs confirm impact across multiple Linux kernel versions including the 6.8 release candidate series (rc1, rc2, rc3).

RemediationAI

Apply the upstream kernel patches available at https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd, https://git.kernel.org/stable/c/c255c3b653c6e8b52ac658c305e2fece2825f7ad, and https://git.kernel.org/stable/c/fc3432ae8232ff4025e7c55012dd88db0e3d18eb - these represent backports to multiple stable branches and are the authoritative fixes. For distribution-packaged kernels (RHEL, Ubuntu, Debian, SUSE, etc.), apply the next available kernel security update from the respective vendor channel, as distro maintainers typically carry these stable backports. An exact patched release version is not independently confirmed from the provided data beyond the upstream commit references. As a compensating control where immediate patching is not feasible, disabling TDLS functionality via iw or wpa_supplicant configuration ('tdls_trigger_control 0' or equivalent) limits the exploitable code path, though this disables direct link optimization and may impact Wi-Fi throughput in environments relying on TDLS. Restricting physical and network access so untrusted users cannot reach the adjacent Wi-Fi segment also reduces the effective attack surface.