CVE-2024-35789

What it actually does

A use-after-free occurs when a station is moved out of a VLAN and the VLAN is deleted; the fast_rx entry retains a dangling pointer to the freed netdev.

Why it matters to the business

Local attackers can achieve arbitrary code execution or kernel crashes on affected Linux systems, leading to full host compromise, data breaches, or denial of service; the kernel is present in virtually every Linux distribution and embedded device, amplifying exposure.

How an attack unfolds

An attacker with local access on a system using mac80211 Wi-Fi triggers VLAN station changes, leaves the fast_rx pointer dangling after VLAN deletion, then reuses the freed memory to execute code. Named actors including espionage and financially motivated groups have targeted similar Linux kernel use-after-free issues in recent zero-day campaigns.

How to fix it

Upgrade the Linux kernel to the commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 or later; rebuild and reboot systems using the affected mac80211 code path.

How to confirm the fix worked

Verify the running kernel contains commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717; inspect mac80211 source for the ieee80211_check_fast_rx call after VLAN changes; test VLAN station move/delete sequences under memory debugging tools.

Typical attack path

1. Obtain local user access on target Linux host
2. Configure or manipulate 802.11 station VLAN membership
3. Delete the VLAN while fast_rx still references its netdev
4. Trigger reuse of the freed netdev pointer via subsequent RX path
5. Achieve kernel code execution or crash

How to detect it

Review kernel logs for use-after-free warnings or oops involving mac80211 or netdev; correlate with VLAN configuration changes in system logs; inspect for unexpected crashes or privilege-escalation attempts around the time of station or VLAN modifications.

What your security team should do

• Immediately apply the referenced kernel commit across all distributions and embedded devices
• Prioritize patching servers and multi-user systems due to local privilege requirement
• Monitor EPSS and threat actor reporting for any increase in observed exploitation
• Restrict local user access and VLAN configuration privileges where feasible