LiveActive security incident?Get immediate response
CVE Record

CVE-2024-44997: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too. Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb(). ---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... ---------

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux networking driver flaw can crash affected MT798X-based systems when one of multiple wireless access-point interfaces on the same band is shut down while WED is enabled. This can interrupt routing or wireless services. The supplied evidence demonstrates a kernel panic, but does not demonstrate data theft, modification, or remote compromise.

Executive priority

Prioritize affected routers, access points, and network appliances where a kernel panic would disrupt critical connectivity. Remediate promptly during a controlled maintenance window. Broad emergency action is not supported because exposure requires specific MediaTek hardware and configuration, and the supplied sources do not report active exploitation.

Technical view

The MediaTek WED traffic-control callback can access cb_priv after it has been freed. The correction clears the pointer after freeing it and makes the callback reject a NULL value. The supplied CVSS is 7.8 with local access and low privileges required. Exact affected-version boundaries are ambiguous in the bundle, so fix-commit verification is preferable.

Likely exposure

Exposure is limited to Linux systems using the affected MediaTek WED Ethernet driver on MT798X hardware, with WED enabled and multiple AP interfaces on one band. The documented trigger occurs when an interface is brought down. Systems without this hardware, driver, configuration, or operational path are unlikely to be exposed.

Exploitation context

CISA KEV status is false in the supplied bundle, and no cited source reports active exploitation. The documented outcome is a reproducible kernel panic under a specific local configuration and interface lifecycle event. Treat broader confidentiality or integrity impact suggested by the CVSS vector as unconfirmed by the provided technical description.

Researcher notes

The demonstrated defect is a use-after-free involving cb_priv during traffic-control block teardown. Three stable-kernel corrections are referenced, likely for different maintained branches. The bundle's affected-version entries are inconsistent, including duplicate commit identifiers and an unexplained version “0”; assess exposure by vendor package advisories and fix-commit ancestry rather than version strings alone.

Mitigation direction

  • Identify MT798X systems using MediaTek WED with multiple AP interfaces on one band.
  • Upgrade to a vendor-supported kernel containing the applicable upstream stable fix.
  • Consult the Linux distribution or device vendor for corrected package and reboot requirements.
  • Until patched, avoid the documented multi-AP WED configuration where operationally acceptable.

Validation and detection

  • Record kernel version, distribution package revision, hardware model, and MediaTek WED configuration.
  • Verify the running kernel contains the applicable referenced stable correction.
  • Confirm multiple same-band AP interfaces and WED are not simultaneously active on unpatched systems.
  • After updating, confirm normal interface shutdown without kernel panic in a controlled environment.
  • Review kernel logs for mtk_wed_setup_tc_block_cb faults or related paging-request traces.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-44997 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-44997Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux799684448e3e1f57257a6155541e53510488f67b, 799684448e3e1f57257a6155541e53510488f67b, 799684448e3e1f57257a6155541e53510488f67bunaffected
LinuxLinux6.2, 0, 6.6.48, 6.10.7, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.