CVE-2024-36921

What it actually does

The vulnerability permits invalid station IDs to reach iwl_mvm_mld_rm_sta_id, resulting in out-of-bounds array accesses within the iwlwifi MVM driver during station removal.

Why it matters to the business

Linux systems using Intel wireless hardware may experience kernel instability or crashes when the driver enters error states during station management, increasing downtime risk for affected endpoints.

How an attack unfolds

An attacker would first force the iwlwifi driver into a bad state through error handling paths during station addition or association, then trigger station removal with an invalid ID to induce the out-of-bounds access.

How to fix it

Apply the upstream fix by updating the Linux kernel to commit 94f80a8ec15e238b78521f20f8afaed60521a294 or later stable releases containing the guard in iwl_mvm_mld_rm_sta_id.

How to confirm the fix worked

Confirm the patch is present by inspecting the iwl_mvm_mld_rm_sta_id function for the invalid ID guard or verify the running kernel contains commit 94f80a8ec15e238b78521f20f8afaed60521a294.

Typical attack path

1. Force driver error condition during WiFi station setup
2. Cause invalid STA ID to be recorded
3. Invoke station removal path
4. Trigger out-of-bounds array access in kernel memory

How to detect it

Review kernel logs for iwlwifi errors around station removal and monitor for unexpected crashes or OOB-related panics on systems with Intel wireless adapters; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all systems with Intel WiFi hardware
• Monitor for driver error logs indicating station management failures
• Test patched kernels in staging environments before broad deployment