01 Record

CVE-2024-49938

wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 17.4% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-10-21 18:01Z2 YR AGO

Last updated

2026-10-15 00:54Z14 DAYS AGO

Reserved

2024-10-21

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-824Access of Uninitialized PointerBase

Data version

5.2

Document digest

0aa39d1887242b5148bffe19322e30b0a27652618cbd48d91498ee36a95cb3ad

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxfb9987d0f748c983bb795a86f47522313f701a08 to < e6b9bf32e0695e4f374674002de0527d2a6768eb, fb9987d0f748c983bb795a86f47522313f701a08 to < d1f2fbc6a769081503f6ffedbb5cd1ac497f0e77, fb9987d0f748c983bb795a86f47522313f701a08 to < b02eb7c86ff2ef1411c3095ec8a52b13f68db04f, fb9987d0f748c983bb795a86f47522313f701a08 to < 012ae530afa0785102360de452745d33c99a321b, fb9987d0f748c983bb795a86f47522313f701a08 to < 6a875220670475d9247e576c15dc29823100a4e4, fb9987d0f748c983bb795a86f47522313f701a08 to < e37e348835032d6940ec89308cc8996ded691d2d, fb9987d0f748c983bb795a86f47522313f701a08 to < 2c230210ec0ae6ed08306ac70dc21c24b817bb95, fb9987d0f748c983bb795a86f47522313f701a08 to < a9f4e28e8adaf0715bd4e01462af0a52ee46b01f, fb9987d0f748c983bb795a86f47522313f701a08 to < 94745807f3ebd379f23865e6dab196f220664179, 2.6.35—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/e6b9bf32e0695e4f374674002de0527d2a6768eb
git.kernel.orghttps://git.kernel.org/stable/c/d1f2fbc6a769081503f6ffedbb5cd1ac497f0e77
git.kernel.orghttps://git.kernel.org/stable/c/b02eb7c86ff2ef1411c3095ec8a52b13f68db04f
git.kernel.orghttps://git.kernel.org/stable/c/012ae530afa0785102360de452745d33c99a321b
git.kernel.orghttps://git.kernel.org/stable/c/6a875220670475d9247e576c15dc29823100a4e4
git.kernel.orghttps://git.kernel.org/stable/c/e37e348835032d6940ec89308cc8996ded691d2d
git.kernel.orghttps://git.kernel.org/stable/c/2c230210ec0ae6ed08306ac70dc21c24b817bb95
git.kernel.orghttps://git.kernel.org/stable/c/a9f4e28e8adaf0715bd4e01462af0a52ee46b01f
git.kernel.orghttps://git.kernel.org/stable/c/94745807f3ebd379f23865e6dab196f220664179
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-355557.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.115-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.11.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.11.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.