boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-27410MEDIUM
Linux Linux — wifi: nl80211: reject iftype change with mesh ID change
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0026   17.3     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 –  —
  Linux    6.0 –                                       6.1.81
TIMELINE
  Feb 25  Reserved by Linux
  May 17  Published (CNA: Linux)
  Aug 4   RESCORED — CVE-2024-27410 (Linux). CVSS 7.8 → 5.5 (NVD).
CNA: Linux · CVSS v3.1 · 10 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has, causing cfg80211_change_iface() to do wrong things when switching. We could probably allow setting an interface to mesh while setting the mesh ID at the same time by doing a different order of operations here, but realistically there's no userspace that's going to do this, so just disallow changes in iftype when setting mesh ID.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
February 25, 2024ReservedReserved by Linux
May 17, 2024PublishedPublished (CNA: Linux)
August 4, 2026RESCOREDRESCORED — CVE-2024-27410 (Linux). CVSS 7.8 → 5.5 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux7b0a0e3c3a88260b6fcb017e49f198463aa62ed1
LinuxLinux6.06.1.81

References (10)

Related

Authoritative record: CVE-2024-27410 at cve.org

Vendors: linux

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-27410 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.