CVE-2024-26666

What it actually does

Missing RCU read-side critical section around link lookup in mac80211 TDLS fast-xmit path allows concurrent modification and potential use of freed objects due to race condition.

Why it matters to the business

Local attackers on affected Linux systems may trigger kernel crashes or memory corruption in wireless networking code, leading to denial of service or limited privilege escalation with low observed exploitation risk.

How an attack unfolds

An attacker with local access triggers concurrent TDLS operations while the unprotected link lookup occurs, racing the RCU-protected dereference to access stale or freed memory structures.

How to fix it

Upgrade the Linux kernel to a version containing the fix that adds proper RCU protection around the TDLS link lookup; the referenced commit eaadf201dcc464f667f0bcda0a2415de2097b8d2 provides the correction.

How to confirm the fix worked

Verify the running kernel contains the RCU protection change in net/mac80211/tdls.c or later equivalent; confirm no unprotected rcu_dereference without rcu_read_lock in the fast-xmit path.

Typical attack path

1. Obtain local access to a Linux system using mac80211 with TDLS enabled
2. Initiate multiple concurrent TDLS link operations
3. Trigger the race window during fast-xmit lookup
4. Cause kernel oops or memory corruption

How to detect it

Review kernel logs for mac80211 or TDLS related oops/panics around the fast-xmit path; inspect for repeated TDLS setup/teardown patterns preceding crashes.

What your security team should do

• Apply the kernel patch or updated distribution packages immediately on all affected systems
• Disable TDLS where not required as a temporary mitigation
• Monitor EPSS and KEV feeds for any future increase in exploit activity