CVE-2021-47194

What it actually does

Local switch of wireless interface type from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via NL80211_CMD_SET_INTERFACE omits cfg80211_stop_ap cleanup, causing re-initialization of in-use sdata->assigned_chanctx_list while still linked in assigned_vifs and corrupting the list.

Why it matters to the business

Linux systems using wireless or P2P interfaces face risk of kernel memory corruption leading to crashes, denial of service, or local privilege escalation; high-urgency patching required for any exposed kernel deployments despite low observed exploitation rates.

How an attack unfolds

An attacker with local access issues a netlink NL80211_CMD_SET_INTERFACE message changing interface type; the missing cleanup path re-inits active list structures, corrupting kernel memory that can be leveraged for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing the fix that ensures cfg80211_stop_ap is invoked on interface type changes; rebuild and reboot with the patched kernel; apply vendor-supplied updates as soon as available.

How to confirm the fix worked

Confirm the presence of the cfg80211_stop_ap call on NL80211_CMD_SET_INTERFACE paths in the running kernel source or via kernel version checks against the published fix commit; test interface type transitions under load to verify absence of list corruption.

Typical attack path

1. Obtain local user access on a Linux system with cfg80211 wireless support
2. Send NL80211_CMD_SET_INTERFACE netlink message to switch from P2P_GO to ADHOC mode
3. Trigger list corruption in assigned_chanctx_list / assigned_vifs
4. Leverage resulting memory corruption for privilege escalation or DoS

How to detect it

Review kernel logs for cfg80211 oops or list corruption traces after interface changes; inspect netlink audit logs for NL80211_CMD_SET_INTERFACE messages switching from P2P_GO to ADHOC; correlate with unexpected wireless interface state changes.

What your security team should do

• Prioritize kernel updates on all systems exposing wireless or P2P interfaces
• Restrict unprivileged netlink access to NL80211 commands where feasible
• Monitor kernel logs for cfg80211-related oops or list corruption warnings
• Harden local access controls to reduce attack surface for local exploits