CVE-2024-36941

What it actually does

Null pointer dereference in nl80211 wireless configuration parsing when coalescing rule handling encounters a failure path, leading to potential kernel memory corruption.

Why it matters to the business

Wireless networking instability or crashes on affected Linux systems may disrupt operations, increase downtime, and require urgent patching across many devices and dependent projects.

How an attack unfolds

An attacker supplies malformed wireless coalescing rules through nl80211 interfaces; when parsing fails the code dereferences a NULL pointer instead of safely handling the error, potentially crashing the kernel or enabling further memory corruption.

How to fix it

Update to a fixed kernel version containing the nl80211 coalescing rule NULL check; for warp-tech/warpgate deployments apply commit e3b26b2699257b9482dce2e9157bd9b5e05d9c76 or later.

How to confirm the fix worked

Confirm the presence of the NULL check before the kfree on the coalescing rule pointer in nl80211 source; test by submitting invalid coalescing rules and verifying no crash occurs.

Typical attack path

1. Identify systems exposing nl80211 wireless configuration interfaces
2. Craft and submit invalid coalescing rule data to trigger the failure path
3. Trigger NULL dereference to cause denial of service or attempt memory corruption escalation

How to detect it

Review kernel logs for nl80211-related NULL pointer dereference oops or panics; inspect wireless configuration submission attempts around the time of any crash.

What your security team should do

• Prioritize kernel updates on all Linux wireless systems within the next 30 days
• Audit wireless configuration code paths for similar NULL handling issues
• Monitor for kernel oops or panic logs related to nl80211