{
  "threat_severity" : "Low",
  "public_date" : "2024-10-21T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: wifi: mt76: mt7915: fix oops on non-dbdc mt7986",
    "id" : "2320225",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2320225"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-823",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nwifi: mt76: mt7915: fix oops on non-dbdc mt7986\nmt7915_band_config() sets band_idx = 1 on the main phy for mt7986\nwith MT7975_ONE_ADIE or MT7976_ONE_ADIE.\nCommit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\") introduced a dereference of the\nphys array indirectly indexed by band_idx via wcid->phy_idx in\nmt76_wcid_cleanup(). This caused the following Oops on affected\nmt7986 devices:\nUnable to handle kernel read from unreadable memory at virtual address 0000000000000024\nMem abort info:\nESR = 0x0000000096000005\nEC = 0x25: DABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x05: level 1 translation fault\nData abort info:\nISV = 0, ISS = 0x00000005\nCM = 0, WnR = 0\nuser pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000\n[0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\nInternal error: Oops: 0000000096000005 [#1] SMP\nModules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ...\nCPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0\nHardware name: ZyXEL EX5700 (Telenor) (DT)\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : mt76_wcid_cleanup+0x84/0x22c [mt76]\nlr : mt76_wcid_cleanup+0x64/0x22c [mt76]\nsp : ffffffc00a803700\nx29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00\nx26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001\nx23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8\nx20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000\nx17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0\nx14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000\nx11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28\nx8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000\nx5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001\nx2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024\nCall trace:\nmt76_wcid_cleanup+0x84/0x22c [mt76]\n__mt76_sta_remove+0x70/0xbc [mt76]\nmt76_sta_state+0x8c/0x1a4 [mt76]\nmt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e]\ndrv_sta_state+0x144/0x274 [mac80211]\nsta_info_move_state+0x1cc/0x2a4 [mac80211]\nsta_set_sinfo+0xaf8/0xc24 [mac80211]\nsta_info_destroy_addr_bss+0x4c/0x6c [mac80211]\nieee80211_color_change_finish+0x1c08/0x1e70 [mac80211]\ncfg80211_check_station_change+0x1360/0x4710 [cfg80211]\ngenl_family_rcv_msg_doit+0xb4/0x110\ngenl_rcv_msg+0xd0/0x1bc\nnetlink_rcv_skb+0x58/0x120\ngenl_rcv+0x34/0x50\nnetlink_unicast+0x1f0/0x2ec\nnetlink_sendmsg+0x198/0x3d0\n____sys_sendmsg+0x1b0/0x210\n___sys_sendmsg+0x80/0xf0\n__sys_sendmsg+0x44/0xa0\n__arm64_sys_sendmsg+0x20/0x30\ninvoke_syscall.constprop.0+0x4c/0xe0\ndo_el0_svc+0x40/0xd0\nel0_svc+0x14/0x4c\nel0t_64_sync_handler+0x100/0x110\nel0t_64_sync+0x15c/0x160\nCode: d2800002 910092c0 52800023 f9800011 (885f7c01)\n---[ end trace 7e42dd9a39ed2281 ]---\nFix by using mt76_dev_phy() which will map band_idx to the correct phy\nfor all hardware combinations." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-47715\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47715\nhttps://lore.kernel.org/linux-cve-announce/2024102120-CVE-2024-47715-ff4e@gregkh/T" ],
  "name" : "CVE-2024-47715",
  "csaw" : false
}