LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57992: wifi: wilc1000: unregister wiphy only if it has been registered

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: unregister wiphy only if it has been registered There is a specific error path in probe functions in wilc drivers (both sdio and spi) which can lead to kernel panic, as this one for example when using SPI: Unable to handle kernel paging request at virtual address 9f000000 when read [9f000000] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: wilc1000_spi(+) crc_itu_t crc7 wilc1000 cfg80211 bluetooth ecdh_generic ecc CPU: 0 UID: 0 PID: 106 Comm: modprobe Not tainted 6.13.0-rc3+ #22 Hardware name: Atmel SAMA5 PC is at wiphy_unregister+0x244/0xc40 [cfg80211] LR is at wiphy_unregister+0x1c0/0xc40 [cfg80211] [...] wiphy_unregister [cfg80211] from wilc_netdev_cleanup+0x380/0x494 [wilc1000] wilc_netdev_cleanup [wilc1000] from wilc_bus_probe+0x360/0x834 [wilc1000_spi] wilc_bus_probe [wilc1000_spi] from spi_probe+0x15c/0x1d4 spi_probe from really_probe+0x270/0xb2c really_probe from __driver_probe_device+0x1dc/0x4e8 __driver_probe_device from driver_probe_device+0x5c/0x140 driver_probe_device from __driver_attach+0x220/0x540 __driver_attach from bus_for_each_dev+0x13c/0x1a8 bus_for_each_dev from bus_add_driver+0x2a0/0x6a4 bus_add_driver from driver_register+0x27c/0x51c driver_register from do_one_initcall+0xf8/0x564 do_one_initcall from do_init_module+0x2e4/0x82c do_init_module from load_module+0x59a0/0x70c4 load_module from init_module_from_file+0x100/0x148 init_module_from_file from sys_finit_module+0x2fc/0x924 sys_finit_module from ret_fast_syscall+0x0/0x1c The issue can easily be reproduced, for example by not wiring correctly a wilc device through SPI (and so, make it unresponsive to early SPI commands). It is due to a recent change decoupling wiphy allocation from wiphy registration, however wilc_netdev_cleanup has not been updated accordingly, letting it possibly call wiphy unregister on a wiphy which has never been registered. Fix this crash by moving wiphy_unregister/wiphy_free out of wilc_netdev_cleanup, and by adjusting error paths in both drivers

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in the wilc1000 Wi-Fi driver. Under a specific device-probe failure path, the driver can try to unregister Wi-Fi state that was never registered, causing a kernel panic. The business impact is primarily availability on affected embedded or Linux systems using this hardware.

Executive priority

Treat this as a targeted availability risk for Linux-based products using wilc1000 Wi-Fi hardware. It is not evidenced as internet-scale or actively exploited, but kernel panics can disrupt embedded devices and field operations. Prioritize asset identification and vendor patch tracking.

Technical view

The wilc1000 SDIO and SPI probe error paths can call wiphy_unregister through wilc_netdev_cleanup even when wiphy registration never completed. The source ties this to a recent change separating wiphy allocation from registration. The kernel fix moves unregister/free handling out of wilc_netdev_cleanup and adjusts both driver error paths.

Likely exposure

Exposure appears limited to Linux systems using the wilc1000 SDIO or SPI Wi-Fi driver, especially embedded devices. The CVE record lists Linux 6.13, 6.13.2, and 6.14 as affected; distro and vendor kernel backports need separate confirmation.

Exploitation context

The source describes reproduction by incorrectly wiring a wilc device over SPI so it is unresponsive to early commands. It does not cite remote exploitation, privilege escalation, public exploit code, or active exploitation. KEV status is false in the supplied bundle.

Researcher notes

The evidence is strong for the root cause and fix direction, but incomplete for CVSS, CWE, exploitability, and distribution-specific affected ranges. Avoid broad Linux exposure claims; focus validation on wilc1000 SDIO/SPI probe behavior and kernel versions carrying the vulnerable cleanup path.

Mitigation direction

  • Check vendor kernel advisories for CVE-2024-57992 applicability and patched package versions.
  • Apply kernel updates containing the referenced stable fixes when available for your platform.
  • Prioritize embedded systems using wilc1000 SDIO or SPI Wi-Fi hardware.
  • Review device-tree, board wiring, and hardware bring-up paths for wilc1000 devices.
  • If no vendor fix exists, monitor vendor guidance rather than creating unsupported kernel changes.

Validation and detection

  • Inventory Linux devices for wilc1000, wilc1000_spi, or wilc1000_sdio driver usage.
  • Confirm running kernel versions against vendor advisories and the CVE affected-version data.
  • Review boot and module-load logs for wilc1000 probe failures or kernel panic traces.
  • Verify patched kernels include the referenced stable commits or vendor-equivalent backports.
  • Ensure regression testing covers wilc1000 probe failure paths on affected hardware.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57992 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfbdf0c5248dce4b55181e9aff8f1b61819ba6bd7, fbdf0c5248dce4b55181e9aff8f1b61819ba6bd7unaffected
LinuxLinux6.13, 0, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.