CVE-2024-35946

What it actually does

Null pointer dereference in the rtw89 wifi driver when a scan cancel operation references a vif that is not actively scanning.

Why it matters to the business

Kernel crashes or instability on Linux systems with affected Realtek wireless hardware during scan operations; widespread kernel usage amplifies potential downtime across servers and devices.

How an attack unfolds

An attacker or malicious process initiates a wireless scan via the rtw89 driver then triggers a cancel under conditions where a non-scanning vif is dereferenced, resulting in a null pointer access and system instability.

How to fix it

Apply the fix from commit b34d64e9aa5505e3c84570aed5c757f1839573e8 in the Linux kernel git tree or upgrade to a stable release containing this patch.

How to confirm the fix worked

Confirm the presence of commit b34d64e9aa5505e3c84570aed5c757f1839573e8 in the kernel source tree or verify updated kernel packages from the distribution.

Typical attack path

1. Initiate a scan request through the rtw89 wifi driver
2. Trigger scan cancellation while the driver state references an incorrect vif
3. Dereference the null or invalid vif pointer leading to kernel memory corruption

How to detect it

Review kernel logs and dmesg output for rtw89-related null pointer dereference or scan abort crashes; correlate with wifi scan activity timestamps.

What your security team should do

• Prioritize kernel updates containing the rtw89 scan fix
• Monitor kernel logs for oops or panic entries referencing rtw89 scan abort
• Test wireless scanning functionality after applying updates