CVE-2024-27410

What it actually does

The vulnerability permits simultaneous iftype and mesh ID changes on a non-mesh interface, resulting in an overwrite of the wdev->u union and subsequent incorrect behavior in cfg80211_change_iface() during interface type transitions.

Why it matters to the business

Unpatched Linux systems using wireless mesh networking may experience instability, failed interface configuration, or unexpected kernel behavior that disrupts wireless connectivity and operations.

How an attack unfolds

An attacker with local access to wireless configuration interfaces issues an nl80211 command that changes both interface type to mesh and mesh ID at once; the kernel performs an unsafe union overwrite, causing cfg80211_change_iface to operate on corrupted state for the prior interface type.

How to fix it

Upgrade the Linux kernel to a version containing commit 930e826962d9f01dcd2220176134427358d112f2 or later; apply the fix from the stable git tree and rebuild/reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 930e826962d9f01dcd2220176134427358d112f2 or verify the source tree no longer permits simultaneous iftype and mesh ID changes when the interface is not already in mesh mode.

Typical attack path

1. Obtain local access or privileges sufficient to invoke nl80211 wireless configuration commands
2. Issue a netlink message that requests simultaneous iftype change to mesh and mesh ID assignment
3. Trigger the flawed code path in nl80211 that performs the union overwrite before proper mode validation
4. Observe or leverage resulting incorrect behavior in cfg80211_change_iface during the switch

How to detect it

Review system logs for nl80211 or cfg80211 errors during interface configuration attempts; inspect audit logs for netlink messages that set mesh ID while changing interface type on non-mesh interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing wireless mesh functionality
• Audit wireless configuration scripts and tools for simultaneous iftype/mesh ID changes
• Monitor for kernel oops or interface configuration failures on wireless devices
• Restrict unprivileged access to nl80211 commands where feasible until patched