What is the CVSS score of CVE-2024-27052?

CVE-2024-27052 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2024-27052?

CVE-2024-27052 affects the rtl8xxxu WiFi driver in Linux systems, creating a privilege escalation risk for local users with low system privileges to gain elevated access.. A patch is available.

How to fix or mitigate CVE-2024-27052?

Within 24 hours, identify all systems using the rtl8xxxu WiFi driver through infrastructure audits and configuration management tools. Within 7 days, obtain the patch available per vendor advisory and validate it in a staging environment to ensure driver functionality and system stability. Within 30 days, deploy the patched kernel version to all affected production systems, beginning with those in sensitive environments or with broader local user access.

Linux Kernel CVE-2024-27052

HIGH

Use After Free (CWE-416)

2024-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption Debian Debian Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires timing control during driver stop, warranting AC:H over NVD's AC:L; local low-privilege access (PR:L) sufficient to trigger driver operations.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 13:00 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:58 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:58 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

7.4 (HIGH) 7.8 (HIGH)

CVE Published

May 01, 2024 - 13:15 cve.org

HIGH 7.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work

The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().

AnalysisAI

Use-after-free in the Linux kernel's rtl8xxxu WiFi driver allows a local attacker with low privileges to corrupt freed kernel memory by racing driver shutdown against an in-flight workqueue. The rtl8xxxu_stop() function failed to call cancel_work_sync() before teardown, leaving c2hcmd_work potentially executing against already-freed driver state - a textbook CWE-416 condition. No public exploit has been identified and EPSS at 0.01% (1st percentile) indicates negligible opportunistic exploitation likelihood; this is not listed in CISA KEV.

Technical ContextAI

The rtl8xxxu driver manages Realtek RTL8xxx series USB WiFi adapters in the Linux kernel. It uses a kernel work item (c2hcmd_work) to process command-to-host (C2H) events asynchronously via the kernel workqueue subsystem. The defect is the absence of cancel_work_sync() in rtl8xxxu_stop(), meaning driver teardown could free underlying data structures while the workqueue was still dispatching against them. This produces a dangling pointer dereference - CWE-416 (Use After Free) - which in a kernel context can be leveraged for memory corruption, privilege escalation, or kernel panic. The CPE confirms Linux kernel broadly (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) and Debian Linux 10.0 as a confirmed downstream. Seven distinct stable-tree patch commits address the issue across multiple kernel branches.

RemediationAI

Apply the upstream kernel patches from the Linux stable tree; patch commits are available at https://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361 and six additional related commits (see NVD references). Debian Buster users should apply the LTS update announced at https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html. Exact fixed package version numbers for specific distributions are not independently confirmed from available data and should be verified through distribution changelogs. As a compensating control for systems not requiring RTL8xxx USB WiFi functionality, blacklisting the rtl8xxxu module via /etc/modprobe.d/blacklist.conf eliminates the attack surface entirely with the trade-off of disabling RTL8xxx USB WiFi hardware on that system.