CVE-2024-26682

What it actually does

The mac80211 subsystem incorrectly treats stale ECSA elements in probe responses as active channel switches, causing connection refusal even when the AP is not performing CSA and when the target channel matches the current one (absent quiet mode).

Why it matters to the business

Linux-based Wi-Fi clients may be unable to associate with otherwise valid access points, resulting in loss of network connectivity for affected systems until the kernel is updated.

How an attack unfolds

An attacker positions a wireless access point that emits probe responses containing persistent ECSA elements; a vulnerable Linux client evaluates the element without the stuck-element heuristic and refuses association, achieving a denial-of-service against connectivity.

How to fix it

Upgrade the Linux kernel to version 6.7.5 or later, or apply the commit ea88bde8e3fefbe4268f6991375dd629895a090a in the stable tree. Reboot affected systems after the update.

How to confirm the fix worked

Confirm the running kernel version is at least 6.7.5; verify that the mac80211 CSA/ECSA refusal logic contains the stuck-element check introduced in the referenced commit.

Typical attack path

1. Attacker configures an AP to include a fixed ECSA element in probe responses
2. Vulnerable client receives the probe response during scanning or roaming
3. mac80211 evaluates the ECSA without checking for prior stuck-element detection
4. Client refuses the connection attempt
5. Client remains disconnected from the target network

How to detect it

Review system logs for repeated mac80211 connection refusal messages referencing CSA or ECSA elements; correlate with wireless scan results showing persistent ECSA in probe responses from target APs.

What your security team should do

• Prioritize kernel upgrades on all Linux Wi-Fi client systems within the next maintenance window
• Monitor upstream stable kernel releases for additional backports
• Temporarily disable Wi-Fi roaming or scanning on high-risk devices if immediate patching is not feasible