CVE-2024-35838

What it actually does

The flaw causes a memory leak of station links in the mac80211 wifi subsystem when a station is allocated during AP MLD connection but removed before links are marked valid.

Why it matters to the business

Gradual memory exhaustion on Linux wireless systems can degrade performance, increase operational costs for maintenance, and risk service disruption in high-density connection environments.

How an attack unfolds

An attacker triggers repeated station allocation and removal sequences in the mac80211 layer before link validation completes, accumulating unreleased memory; Android kernel exploitation paths may be adapted for similar resource depletion.

How to fix it

Upgrade affected Linux kernel trees to the fixed commit 49aaeb8c539b1633b3bd7c2df131ec578aa1eae1 or equivalent stable releases containing the patch.

How to confirm the fix worked

Verify kernel source includes commit 49aaeb8c539b1633b3bd7c2df131ec578aa1eae1; inspect mac80211 station handling code for the link validity check before removal.

Typical attack path

1. Initiate station allocation via wireless connection attempt to an AP MLD
2. Force station removal without completing link validation
3. Repeat the sequence to exhaust kernel memory resources

How to detect it

Examine kernel logs for repeated station add/remove events in mac80211 without link validation markers; correlate with unexplained memory growth in wireless drivers.

What your security team should do

• Prioritize kernel updates on all Linux wifi-enabled systems within standard patch windows
• Monitor memory utilization metrics for mac80211 subsystems in production environments
• Review wireless connection handling logs for abnormal station allocation patterns