CVE-2024-26694

What it actually does

Double-free in kernel memory allocation for TLV PC register data in iwlwifi firmware parsing path when a subsequent file load fails after initial parse, because storage was not cleared with other drv->fw allocations and lacked explicit NULL after free.

Why it matters to the business

Potential kernel crashes, denial of service, or memory corruption on Linux systems using Intel WiFi hardware; low exploit likelihood reduces urgency but still requires patching to avoid stability issues in high-availability environments.

How an attack unfolds

An attacker with local access crafts conditions to trigger firmware file parse success followed by load failure, then forces another deallocation path that re-frees the already-freed TLV storage, resulting in double-free and subsequent memory corruption or crash.

How to fix it

Update Linux kernel to a version containing commit ab9d4bb9a1892439b3123fc52b19e32b9cdf80ad which adds the missing NULL assignment after explicit free of TLV PC register data.

How to confirm the fix worked

Verify kernel source contains the NULL assignment after kfree of the TLV data structure; boot patched kernel and confirm no double-free warnings during failed firmware load sequences in dmesg.

Typical attack path

1. Gain local execution on affected Linux system with iwlwifi driver
2. Trigger WiFi firmware reload or module re-initialization
3. Cause first firmware parse to succeed but subsequent load to fail
4. Trigger second free path during driver cleanup
5. Exploit resulting double-free for memory corruption or DoS

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for double-free warnings, slab corruption messages, or iwlwifi firmware parse errors followed by oops/panic during driver unload or reload sequences.

• iwlwifi.*double-free
• kfree.*TLV.*PC.*register
• slab.*corruption.*iwlwifi

What your security team should do

• Apply the referenced kernel commit or upgrade to a stable release containing the fix as soon as practical
• Monitor kernel logs for iwlwifi firmware load failures on affected hardware
• Prioritize systems with Intel WiFi cards in production or exposed environments