CVE-2024-26637

What it actually does

Use-after-free in ath11k Wi-Fi driver when mac80211 deletes debugfs entries for a vif; subsequent ath11k deletion attempt references freed memory and crashes the kernel.

Why it matters to the business

Systems with ath11k hardware on affected kernels can suffer sudden crashes during normal Wi-Fi interface lifecycle events, causing loss of connectivity and unplanned downtime until reboot.

How an attack unfolds

An attacker triggers Wi-Fi virtual interface addition or removal conditions that cause mac80211 to manage debugfs entries; ath11k later attempts to delete the same entries, dereferencing freed memory and panicking the kernel.

How to fix it

Upgrade to Linux kernel 6.7.3 or later, or apply commit aa74ce30a8a40d19a4256de4ae5322e71344a274; AlmaLinux 8 users should install tlog 11-1.el8 or newer.

How to confirm the fix worked

Confirm running kernel is 6.7.3+, verify the fix commit is present in the kernel source tree, and ensure no ath11k debugfs double-delete oops occur under normal interface add/remove operations.

Typical attack path

1. Cause mac80211 to delete debugfs entries for a vif
2. Trigger ath11k vif_add_debugfs or removal path that also attempts deletion
3. Kernel dereferences freed debugfs object resulting in panic

How to detect it

Review kernel ring buffer and dmesg for ath11k or debugfs related use-after-free or NULL pointer dereference oops; inspect system logs around times of unexpected reboots for Wi-Fi interface events.

What your security team should do

• Apply the kernel update to all systems containing ath11k hardware
• Reboot after package installation to load the fixed kernel
• Monitor kernel logs for ath11k debugfs warnings until patches are deployed