CVE-2024-36922

What it actually does

Race condition in the iwlwifi driver allows txq->read_ptr to be read outside the lock, enabling the same TX queue entry to be reclaimed twice and triggering a kernel warning.

Why it matters to the business

Linux systems using Intel WiFi hardware may experience kernel warnings, driver instability, or availability loss under concurrent TX queue operations, increasing operational risk for large fleets with many downstream kernel dependents.

How an attack unfolds

An attacker with local access triggers concurrent reclamation paths in the iwlwifi TX queue logic so that an unlocked read of read_ptr yields a stale value, allowing the same descriptor to be freed twice.

How to fix it

Upgrade the Linux kernel to commit b83db8e756dec68a950ed2f056248b1704b3deaa or later stable releases containing the fix that reads txq->read_ptr under the appropriate lock.

How to confirm the fix worked

Verify the running kernel contains commit b83db8e756dec68a950ed2f056248b1704b3deaa; confirm absence of the double-reclaim WARN_ONCE under load that exercises iwlwifi TX paths.

Typical attack path

1. Obtain local code execution or user context on an affected Linux system
2. Trigger concurrent TX queue reclaim operations in the iwlwifi driver
3. Exploit the unlocked read of txq->read_ptr to cause double reclaim
4. Observe resulting WARN_ONCE and potential driver or system instability

How to detect it

Search kernel logs for the iwlwifi double-reclaim WARN_ONCE message and review dmesg or journalctl output around periods of heavy TX queue activity on Intel WiFi adapters.

What your security team should do

• Prioritize kernel updates on all systems using Intel iwlwifi hardware
• Apply the fix within standard patch windows given low EPSS and no KEV listing
• Monitor for the specific WARN_ONCE signature in kernel logs on affected hardware
• Review downstream kernel dependents and schedule updates for high-prevalence environments