What is the CVSS score of CVE-2024-26779?

CVE-2024-26779 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-26779?

Linux kernel race condition (CVE-2024-26779) in the mac80211 WiFi subsystem affects all systems running on WiFi hardware, enabling denial-of-service attacks through kernel panics.. A patch is available.

How to fix or mitigate CVE-2024-26779?

Within 24 hours: conduct inventory of systems running Linux with mac80211-based WiFi hardware and document current kernel versions on each system. Within 7 days: consult kernel.org and your Linux distribution's security advisories to identify the specific affected kernel versions for your deployed distributions, test available stable-branch patches in non-production, and develop a distribution-specific rollout plan. Within 30 days: deploy patched kernel versions to all production systems running affected software, prioritizing systems that depend on WiFi for connectivity, and verify patching through kernel version audits across your infrastructure.

Linux Kernel CVE-2024-26779

HIGH

Race Condition (CWE-362)

2024-04-03 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux Race Condition Debian Debian Linux

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

WiFi-adjacent trigger (AV:A); race condition requires precise timing (AC:H); kernel crash is primary impact (A:H); uninitialized read offers limited info exposure (C:L); no integrity impact supported by description.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:35 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:34 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 13:34 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 8.8 (HIGH)

CVE Published

Apr 03, 2024 - 17:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix race condition on enabling fast-xmit

fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.

AnalysisAI

Race condition in the Linux kernel's mac80211 WiFi subsystem allows network-adjacent attackers to trigger kernel panics by inducing fast-xmit activation before a station object has been fully uploaded to the wireless driver, causing access to uninitialized drv_priv memory. All systems running affected kernel versions with mac80211-based WiFi hardware are exposed to denial-of-service. EPSS is 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code has been identified, though eight upstream stable-branch patch commits are available on kernel.org.

Technical ContextAI

mac80211 is the Linux kernel's software IEEE 802.11 (WiFi) MAC layer, sitting between hardware drivers and the networking stack. fast-xmit is a performance optimization that bypasses normal TX path overhead for known associated stations. The race condition (CWE-362) occurs because fast-xmit can be activated for a station object before sta->uploaded is set - meaning the driver has not yet initialized its private per-STA state (drv_priv). When a drv_tx() call subsequently accesses that uninitialized memory, the result is undefined behavior, most commonly a kernel panic. The fix adds a sta->uploaded guard before fast-xmit is enabled and re-evaluates eligibility after station insertion completes. CPE data confirms broad Linux kernel impact across multiple stable branches, with Linux kernel 6.8-rc1 and Debian Linux 10.0 (Buster) explicitly identified in NVD records.

RemediationAI

Apply the upstream kernel stable patches available at the kernel.org commit links provided in references, notably https://git.kernel.org/stable/c/eb39bb548bf974acad7bd6780fe11f9e6602d696 and the seven companion commits targeting other stable branches. Distribution-specific patched kernel packages should be verified with vendor security channels - for Debian 10.0, monitor Debian Security Advisories (DSA) for a backported fix. Exact patched kernel release version numbers are not independently confirmed beyond raw upstream commits; verify the specific version with your distribution vendor before assuming coverage. If immediate patching is not feasible, unloading the mac80211 kernel module (modprobe -r mac80211) eliminates WiFi-subsystem exposure entirely, though it disables all WiFi connectivity on the host and is suitable only as a short-term compensating control.