Linux Kernel
CVE-2024-27053
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only WiFi access required; race condition makes reliable triggering AC:H; impact is kernel panic only, no confidentiality or integrity compromise established.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix RCU usage in connect path
With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning:
========= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c
This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies data
AnalysisAI
Improper RCU pointer dereference in the Linux kernel wilc1000 WiFi driver allows an adjacent-network attacker to trigger a null pointer dereference and kernel panic during WiFi connect operations. Systems running Microchip/Atmel SAMA5 embedded hardware with the wilc1000 chip are affected across multiple stable kernel branches; the bug manifests when wpa_supplicant initiates a connection and wilc_parse_join_bss_param dereferences an RCU-protected BSS pointer outside a read-lock critical section. No public exploit or CISA KEV listing exists; EPSS of 0.12% at the 31st percentile reflects minimal observed exploitation activity.
Technical ContextAI
RCU (Read-Copy-Update) is the Linux kernel's high-performance read-mostly synchronization mechanism. Pointers protected by RCU must only be dereferenced inside an rcu_read_lock()/rcu_read_unlock() critical section, which prevents the pointed-to memory from being reclaimed while in use. In drivers/net/wireless/microchip/wilc1000/hif.c at line 386, wilc_parse_join_bss_param() calls rcu_dereference_check() outside such a section when processing BSS IE data during cfg80211_connect. The root cause class is CWE-476 (Null Pointer Dereference): if the RCU-protected BSS structure is freed between the pointer load and the subsequent access, the kernel dereferences a stale or null pointer, causing a panic. The wilc1000 is a Microchip (formerly Atmel) 802.11 b/g/n WiFi chip targeted at embedded systems; affected CPEs confirm all Linux kernel versions across multiple stable series, plus Debian Linux 10.0 as a downstream consumer.
RemediationAI
Apply the upstream stable kernel patches available at https://git.kernel.org/stable/c/205c50306acf58a335eb19fa84e40140f4fe814f and the seven sibling commits across affected stable branches. The fix narrows the RCU read critical section to cover only the IE data copy within wilc_parse_join_bss_param, avoiding the broader lock-holding cost while correcting the invalid dereference. Debian users should apply available kernel security updates via standard package management. As a workaround where patching is not immediately feasible, disabling WiFi connectivity managed by wpa_supplicant on affected wilc1000 systems eliminates the vulnerable code path entirely; the trade-off is loss of wireless networking. No released fixed kernel version number is explicitly confirmed in the available reference data - patch status is confirmed via upstream stable commits only, not a tagged release.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today