CVE-2024-26683

What it actually does

The kernel's cfg80211 validation rejects probe responses containing a permanently advertised ECSA element, preventing association to affected APs even when no channel switch is occurring.

Why it matters to the business

Linux Wi-Fi clients experience persistent connection failures to certain access points, disrupting network access for users and devices until the kernel is updated.

How an attack unfolds

An attacker does not actively exploit this; the flaw manifests when a Linux client attempts to associate with an AP that has a stuck ECSA element in its probe responses, causing the new validation logic to block the connection indefinitely.

How to fix it

Update the Linux kernel to version 6.7.5 or later, or apply the fix from commit ce112c941c2b172afba3e913a90c380647d53975 in the stable git tree.

How to confirm the fix worked

Confirm the kernel version is at least 6.7.5 and test association to APs previously reporting stuck ECSA elements; verify the new detection logic allows connection when appropriate.

Typical attack path

1. Client scans for APs and receives probe response with permanent ECSA element
2. cfg80211 validation incorrectly flags the AP as undergoing channel switch
3. Connection attempt is aborted by mac80211
4. Client remains disconnected from the affected AP

How to detect it

Review kernel logs for connection refusal messages related to channel switch announcements; inspect probe response captures for persistent ECSA elements from target APs.

What your security team should do

• Prioritize kernel upgrades on all Linux Wi-Fi client systems within the next maintenance window
• Monitor vendor firmware updates for affected APs such as the Asus RT-AC53
• Add kernel version checks to vulnerability scanning policies