LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57991: wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles() During rtw89_entity_recalc_mgnt_roles(), there is a normalizing process which will re-order the list if an entry with target pattern is found. And once one is found, should have aborted the list_for_each_entry. But, `break` just aborted the inner for-loop. The outer list_for_each_entry still continues. Normally, only the first entry will match the target pattern, and the re-ordering will change nothing, so there won't be soft lockup. However, in some special cases, soft lockup would happen. Fix it by `goto fill` to break from the list_for_each_entry. The following is a sample of kernel log for this problem. watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [wpa_supplicant:2055] [...] RIP: 0010:rtw89_entity_recalc ([...] chan.c:392 chan.c:479) rtw89_core [...]

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel Wi-Fi driver flaw can cause a system soft lockup, creating a denial-of-service risk on affected systems using the rtw89 Realtek Wi-Fi driver. It does not indicate data theft or privilege escalation in the provided sources.

Executive priority

Treat as a targeted availability issue, not a broad data compromise. Patch affected Linux endpoints during normal security maintenance, with higher priority for systems where Wi-Fi downtime disrupts operations.

Technical view

The bug is in rtw89_entity_recalc_mgnt_roles(). During list reordering, a break exits only an inner loop, allowing the outer list iteration to continue after normalization. In special cases this can cause a soft lockup, with logs showing wpa_supplicant stuck in rtw89 code.

Likely exposure

Exposure appears limited to affected Linux kernels using the rtw89 Wi-Fi driver. The source lists Linux 6.13, 6.13.2, and 6.14-related affected version data, plus fixing stable commits.

Exploitation context

The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. KEV is false, and the supplied sources do not report active exploitation or public exploit use.

Researcher notes

The source evidence is concise and kernel-specific. It supports a denial-of-service assessment through soft lockup, but does not provide affected hardware lists, distribution status, exploit reports, or operational workarounds beyond applying the fix.

Mitigation direction

  • Update to a kernel or distro package containing the referenced stable fixes.
  • Check Linux distribution advisories for the backported fix status.
  • Prioritize laptops, workstations, or appliances using Realtek rtw89 Wi-Fi hardware.
  • Where feasible, avoid affected rtw89 Wi-Fi use until patched.
  • Monitor kernel logs for soft lockup messages involving rtw89 code.

Validation and detection

  • Inventory systems running affected Linux kernel versions.
  • Confirm whether the rtw89 driver is loaded or required.
  • Verify the running kernel includes one of the referenced stable commits or vendor backport.
  • Review kernel logs for rtw89_entity_recalc or soft lockup messages.
  • Confirm remediation after reboot into the patched kernel.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57991 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2024-57991Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0007546cb406be0dddf3d43f07683825affc6d4d, 68ec751b288178de7d19b71ea61648269a35b8cd, 68ec751b288178de7d19b71ea61648269a35b8cdunaffected
LinuxLinux6.13, 0, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.