wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from softirq context. However using only spin_lock() to get sta->ps_lock in ieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute on this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to take this same lock ending in deadlock. Below is an example of rcu stall that arises in such situation. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996 rcu: (t=42586894 jiffies g=2057 q=362405 ncpus=4) CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G W 6.4.0-02158-g1b062f552873 #742 Hardware name: RPT (r1) (DT) pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : queued_spin_lock_slowpath+0x58/0x2d0 lr : invoke_tx_handlers_early+0x5b4/0x5c0 sp : ffff00001ef64660 x29: ffff00001ef64660 x28: ffff000009bc1070 x27: ffff000009bc0ad8 x26: ffff000009bc0900 x25: ffff00001ef647a8 x24: 0000000000000000 x23: ffff000009bc0900 x22: ffff000009bc0900 x21: ffff00000ac0e000 x20: ffff00000a279e00 x19: ffff00001ef646e8 x18: 0000000000000000 x17: ffff800016468000 x16: ffff00001ef608c0 x15: 0010533c93f64f80 x14: 0010395c9faa3946 x13: 0000000000000000 x12: 00000000fa83b2da x11: 000000012edeceea x10: ffff0000010f
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.6.35, 6.9.6
- CVEs
- CVE-2024-40912
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 10:30 UTC · Revision 1
Source evidence
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
core-osv · Original sourcePublished 12 Jul 2024, 12:20 UTC
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from softirq context. However using only spin_lock() to get sta->ps_lock in ieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute on this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to take this same lock ending in deadlock. Below is an example of rcu stall that arises in such situation. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996 rcu: (t=42586894 jiffies g=2057 q=362405 ncpus=4) CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G W 6.4.0-02158-g1b062f552873 #742 Hardware name: RPT (r1) (DT) pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : queued_spin_lock_slowpath+0x58/0x2d0 lr : invoke_tx_handlers_early+0x5b4/0x5c0 sp : ffff00001ef64660 x29: ffff00001ef64660 x28: ffff000009bc1070 x27: ffff000009bc0ad8 x26: ffff000009bc0900 x25: ffff00001ef647a8 x24: 0000000000000000 x23: ffff000009bc0900 x22: ffff000009bc0900 x21: ffff00000ac0e000 x20: ffff00000a279e00 x19: ffff00001ef646e8 x18: 0000000000000000 x17: ffff800016468000 x16: ffff00001ef608c0 x15: 0010533c93f64f80 x14: 0010395c9faa3946 x13: 0000000000000000 x12: 00000000fa83b2da x11: 000000012edeceea x10: ffff0000010f
osv:CVE-2024-40912
Kernel
Fixed versions: 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, 6.6.35, 6.9.6
Complete source record
{
"id": "b284ddde58d1deace42eaf84d3fbdb270e60a8dc177c27722efe911a10796515",
"url": "https://osv.dev/vulnerability/CVE-2024-40912",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from softirq context. However using only spin_lock() to get sta->ps_lock in ieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute on this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to take this same lock ending in deadlock. Below is an example of rcu stall that arises in such situation. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996 rcu: (t=42586894 jiffies g=2057 q=362405 ncpus=4) CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G W 6.4.0-02158-g1b062f552873 #742 Hardware name: RPT (r1) (DT) pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : queued_spin_lock_slowpath+0x58/0x2d0 lr : invoke_tx_handlers_early+0x5b4/0x5c0 sp : ffff00001ef64660 x29: ffff00001ef64660 x28: ffff000009bc1070 x27: ffff000009bc0ad8 x26: ffff000009bc0900 x25: ffff00001ef647a8 x24: 0000000000000000 x23: ffff000009bc0900 x22: ffff000009bc0900 x21: ffff00000ac0e000 x20: ffff00000a279e00 x19: ffff00001ef646e8 x18: 0000000000000000 x17: ffff800016468000 x16: ffff00001ef608c0 x15: 0010533c93f64f80 x14: 0010395c9faa3946 x13: 0000000000000000 x12: 00000000fa83b2da x11: 000000012edeceea x10: ffff0000010f",
"evidence": "osv:CVE-2024-40912",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.19.317",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.279",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.221",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.162",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.95",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.35",
"evidence": "/affected/1/ranges"
},
{
"value": "6.9.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2024-40912",
"aliases": [
"CVE-2024-40912"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1d147bfa64293b2723c4fec50922168658e613ba"
},
{
"fixed": "e51637e0c66a6f72d134d9f95daa47ea62b43c7e"
},
{
"fixed": "28ba44d680a30c51cf485a2f5a3b680e66ed3932"
},
{
"fixed": "e7e916d693dcb5a297f40312600a82475f2e63bc"
},
{
"fixed": "d90bdff79f8e40adf889b5408bfcf521528b169f"
},
{
"fixed": "9c49b58b9a2bed707e7638576e54c4bccd97b9eb"
},
{
"fixed": "456bbb8a31e425177dc0e8d4f98728a560c20e81"
},
{
"fixed": "47d176755d5c0baf284eff039560f8c1ba0ea485"
},
{
"fixed": "44c06bbde6443de206b30f513100b5670b23fc5e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.2.56"
},
{
"fixed": "3.3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.4.84"
},
{
"fixed": "3.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.10.34"
},
{
"fixed": "3.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.12.15"
},
{
"fixed": "3.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.13.7"
},
{
"fixed": "3.14"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ad64b463d919a18be70b281efb135231169caf4a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "46a5a5493360f995b834eb3b828eb59da4604509"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a7ee1a84a81555b19ec3d02f104bfd70cf0b668a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "58d4310586466840dab77e56e53f4508853a5268"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fcb6d3c79824d350893edfa7b50d6ba1f670c4ec"
}
]
}
],
"versions": [
"v3.2.102",
"v3.2.101",
"v3.2.100",
"v3.2.99",
"v3.2.98",
"v3.2.97",
"v3.2.96",
"v3.2.95",
"v3.2.94",
"v3.2.93",
"v3.2.92",
"v3.2.91",
"v3.2.90",
"v3.2.89",
"v3.2.88",
"v3.2.87",
"v3.2.86",
"v3.2.85",
"v3.2.84",
"v3.2.83",
"v3.2.82",
"v3.2.81",
"v3.2.80",
"v3.2.79",
"v3.2.78",
"v3.2.77",
"v3.2.76",
"v3.2.75",
"v3.2.74",
"v3.2.73",
"v3.2.72",
"v3.2.71",
"v3.2.70",
"v3.2.69",
"v3.2.68",
"v3.2.67",
"v3.2.66",
"v3.2.65",
"v3.2.64",
"v3.2.63",
"v3.2.62",
"v3.2.61",
"v3.2.60",
"v3.2.59",
"v3.2.58",
"v3.2.57",
"v3.2.56",
"v3.4.113",
"v3.4.112",
"v3.4.111",
"v3.4.110",
"v3.4.109",
"v3.4.108",
"v3.4.107",
"v3.4.106",
"v3.4.105",
"v3.4.104",
"v3.4.103",
"v3.4.102",
"v3.4.101",
"v3.4.100",
"v3.4.99",
"v3.4.98",
"v3.4.97",
"v3.4.96",
"v3.4.95",
"v3.4.94",
"v3.4.93",
"v3.4.92",
"v3.4.91",
"v3.4.90",
"v3.4.89",
"v3.4.88",
"v3.4.87",
"v3.4.86",
"v3.4.85",
"v3.4.84",
"v3.10.108",
"v3.10.107",
"v3.10.106",
"v3.10.105",
"v3.10.104",
"v3.10.103",
"v3.10.102",
"v3.10.101",
"v3.10.100",
"v3.10.99",
"v3.10.98",
"v3.10.97",
"v3.10.96",
"v3.10.95",
"v3.10.94",
"v3.10.93",
"v3.10.92",
"v3.10.91",
"v3.10.90",
"v3.10.89",
"v3.10.88",
"v3.10.87",
"v3.10.86",
"v3.10.85",
"v3.10.84",
"v3.10.83",
"v3.10.82",
"v3.10.81",
"v3.10.80",
"v3.10.79",
"v3.10.78",
"v3.10.77",
"v3.10.76",
"v3.10.75",
"v3.10.74",
"v3.10.73",
"v3.10.72",
"v3.10.71",
"v3.10.70",
"v3.10.69",
"v3.10.68",
"v3.10.67",
"v3.10.66",
"v3.10.65",
"v3.10.64",
"v3.10.63",
"v3.10.62",
"v3.10.61",
"v3.10.60",
"v3.10.59",
"v3.10.58",
"v3.10.57",
"v3.10.56",
"v3.10.55",
"v3.10.54",
"v3.10.53",
"v3.10.52",
"v3.10.51",
"v3.10.50",
"v3.10.49",
"v3.10.48",
"v3.10.47",
"v3.10.46",
"v3.10.45",
"v3.10.44",
"v3.10.43",
"v3.10.42",
"v3.10.41",
"v3.10.40",
"v3.10.39",
"v3.10.38",
"v3.10.37",
"v3.10.36",
"v3.10.35",
"v3.10.34",
"v3.12.74",
"v3.12.73",
"v3.12.72",
"v3.12.71",
"v3.12.70",
"v3.12.69",
"v3.12.68",
"v3.12.67",
"v3.12.66",
"v3.12.65",
"v3.12.64",
"v3.12.63",
"v3.12.62",
"v3.12.61",
"v3.12.60",
"v3.12.59",
"v3.12.58",
"v3.12.57",
"v3.12.56",
"v3.12.55",
"v3.12.54",
"v3.12.53",
"v3.12.52",
"v3.12.51",
"v3.12.50",
"v3.12.49",
"v3.12.48",
"v3.12.47",
"v3.12.46",
"v3.12.45",
"v3.12.44",
"v3.12.43",
"v3.12.42",
"v3.12.41",
"v3.12.40",
"v3.12.39",
"v3.12.38",
"v3.12.37",
"v3.12.36",
"v3.12.35",
"v3.12.34",
"v3.12.33",
"v3.12.32",
"v3.12.31",
"v3.12.30",
"v3.12.29",
"v3.12.28",
"v3.12.27",
"v3.12.26",
"v3.12.25",
"v3.12.24",
"v3.12.23",
"v3.12.22",
"v3.12.21",
"v3.12.20",
"v3.12.19",
"v3.12.18",
"v3.12.17",
"v3.12.16",
"v3.12.15",
"v3.13.11",
"v3.13.10",
"v3.13.9",
"v3.13.8",
"v3.13.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40912.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.14.0"
},
{
"fixed": "4.19.317"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.279"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.162"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.95"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.35"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.9.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40912.json"
}
}
],
"modified": "2026-10-28T02:30:43.798563724Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-265688.html",
"https://cert-portal.siemens.com/productcert/html/ssa-355557.html",
"https://git.kernel.org/stable/c/28ba44d680a30c51cf485a2f5a3b680e66ed3932",
"https://git.kernel.org/stable/c/44c06bbde6443de206b30f513100b5670b23fc5e",
"https://git.kernel.org/stable/c/456bbb8a31e425177dc0e8d4f98728a560c20e81",
"https://git.kernel.org/stable/c/47d176755d5c0baf284eff039560f8c1ba0ea485",
"https://git.kernel.org/stable/c/9c49b58b9a2bed707e7638576e54c4bccd97b9eb",
"https://git.kernel.org/stable/c/d90bdff79f8e40adf889b5408bfcf521528b169f",
"https://git.kernel.org/stable/c/e51637e0c66a6f72d134d9f95daa47ea62b43c7e",
"https://git.kernel.org/stable/c/e7e916d693dcb5a297f40312600a82475f2e63bc",
"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40912.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-40912",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40912.json"
}
},
"related_cves": [
{
"value": "CVE-2024-40912",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 511626,
"published_at": "2024-07-12T12:20:50.488+00:00"
}