CVE-2024-26693

What it actually does

The flaw causes a null pointer dereference crash in the iwlwifi driver when ieee80211_find_sta_by_ifaddr returns a station object whose iwl_mvm_sta has not been initialized because the firmware rejected station allocation due to resource exhaustion.

Why it matters to the business

An unauthenticated attacker can remotely crash affected Linux systems running the iwlwifi driver, causing loss of wireless connectivity and potential system instability until reboot.

How an attack unfolds

An attacker uses a tool to flood the access point with authentication frames until the firmware station table is full; the driver silently fails to add the station yet reports success to mac80211, leaving a partially initialized station object; subsequent received frames trigger iwl_mvm_is_dup which dereferences uninitialized per-queue data and crashes the kernel.

How to fix it

Update to a kernel containing commit 00f4eb31b8193f6070ce24df636883f9c104ca95 or later; ensure the iwlwifi driver properly returns an error when firmware station allocation fails.

How to confirm the fix worked

Confirm the running kernel contains commit 00f4eb31b8193f6070ce24df636883f9c104ca95 or a backport; test by replaying authentication-frame floods and verifying the system no longer crashes.

Typical attack path

1. Send large numbers of authentication frames from one or more spoofed addresses
2. Trigger firmware station exhaustion without returning an error to mac80211
3. Cause mac80211 to mark the station as uploaded
4. Send data frames that reach iwl_mvm_is_dup on the incomplete station object
5. Trigger kernel panic

How to detect it

Review kernel logs for oops or panic messages referencing iwl_mvm_is_dup or station allocation failure; correlate with wireless interface activity and authentication frame volume before the crash.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems using iwlwifi hardware
• Monitor vendor advisories for distribution-specific backports
• Consider rate-limiting authentication frames at the wireless infrastructure level as a temporary control