CVE-2023-52595

What it actually does

After a hardware reset, the rt2x00 driver fails to stop the beacon queue, leaving it deadlocked so that mac80211 cannot restart transmission and clients cannot associate.

Why it matters to the business

Wireless access points using the affected kernel may become unreachable to clients after any hardware reset, causing prolonged loss of network service until the system is rebooted or the driver is reloaded.

How an attack unfolds

An attacker with local access triggers a hardware reset (for example via a driver reload or power-management event); the beacon queue deadlocks and remains stopped; subsequent association attempts from clients, including Apple devices, fail because the AP cannot transmit beacons.

How to fix it

Upgrade the Linux kernel to a version containing commit e1f113b57ddd18274d7c83618deca25cc880bc48 or later; rebuild and reboot with the patched driver.

How to confirm the fix worked

Confirm the running kernel contains commit e1f113b57ddd18274d7c83618deca25cc880bc48; trigger ieee80211_restart_hw and verify that beacon transmission resumes and clients can associate.

Typical attack path

1. Obtain local access to a system running the vulnerable rt2x00 driver
2. Trigger ieee80211_restart_hw or equivalent hardware reset
3. Observe that the beacon queue remains stopped
4. Deny service to wireless clients attempting to associate

How to detect it

Review kernel logs for rt2x00 beacon queue warnings or deadlocks following ieee80211_restart_hw calls; correlate with client association failures on affected hardware.

What your security team should do

• Apply the referenced kernel commit immediately on all affected wireless systems
• Prioritize systems acting as access points or using rt2x00 hardware
• Monitor for availability events on wireless interfaces after any driver or hardware reset