CVE-2024-35913

What it actually does

Incorrect version check for SESSION_PROTECTION_NOTIF in iwlwifi mvm driver causes access to wrong struct field (mac_id vs link_id) in iwl_mvm_rx_session_protect_notif, triggering kernel WARNING at time-event.c:959.

Why it matters to the business

Wireless networking instability and kernel warnings on affected Linux systems using Intel WiFi hardware; low urgency given no known exploitation but still requires patching for stability.

How an attack unfolds

No attacker exploitation path exists; the flaw triggers during legitimate WiFi session protection notifications processed by iwl_mvm_rx_common regardless of intent, with no threat actors or ransomware usage observed.

How to fix it

Upgrade to Linux kernel 6.8.5 or later; apply commit 222abd95f503e28c0404e596291fe472fe90929c from the stable git repository for affected branches.

How to confirm the fix worked

Confirm running kernel version >= 6.8.5; reproduce WiFi events and verify absence of the time-event.c:959 WARNING in dmesg or kernel logs.

Typical attack path

1. Establish WiFi connection triggering SESSION_PROTECTION_NOTIF
2. Driver processes notification using incorrect struct field access
3. Kernel emits WARNING in iwl_mvm_rx_session_protect_notif

How to detect it

Search kernel logs and dmesg for the exact WARNING string referencing iwl_mvm_rx_session_protect_notif and time-event.c:959; review recent WiFi connection events for correlation.

• iwl_mvm_rx_session_protect_notif+0x333/0x340
• WARNING: CPU:.* at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959
• iwl_mvm_rx_session_protect_notif

What your security team should do

• Prioritize kernel upgrades on systems with Intel WiFi to fixed versions
• Monitor kernel logs for iwl_mvm related warnings as part of routine stability checks
• Apply patches via distribution update mechanisms without delay for affected stable kernels