CVE-2024-35912

What it actually does

Failure to release a previously allocated command response buffer in the iwlwifi RFI handler when an RX payload length check fails or kmemdup() fails, resulting in a kernel memory leak.

Why it matters to the business

Gradual depletion of kernel memory on systems using affected Intel WiFi hardware can lead to performance degradation or crashes, increasing operational overhead for patching fleets of Linux devices.

How an attack unfolds

An attacker with local access triggers the RFI command path under conditions that cause the length check or allocation to fail, leaving the original response buffer unfreed and allowing repeated leaks to exhaust memory.

How to fix it

Update the Linux kernel to a version containing commit 28db0ae86cb91a4ab0e855cff779daead936b7d5 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 28db0ae86cb91a4ab0e855cff779daead936b7d5 and verify the RFI response free logic is present in the iwlwifi mvm rfi code.

Typical attack path

1. Obtain local access on a Linux system with vulnerable iwlwifi driver
2. Craft or trigger RFI-related wireless commands that exercise the error paths
3. Repeat to accumulate leaked kernel memory
4. Observe system impact from memory exhaustion

How to detect it

Review kernel logs for repeated iwlwifi RFI allocation failures without corresponding frees; inspect memory leak detectors or slab usage counters after wireless activity.

What your security team should do

• Prioritize kernel updates on all systems using Intel WiFi hardware
• Monitor memory usage on WiFi-enabled endpoints for unexplained growth
• Apply the fix during the next maintenance window given low EPSS and no KEV listing