CVE-2024-42125

What it actually does

NULL pointer dereference in the rtw89 WiFi driver scan offload path when the 6 GHz sband structure is absent due to BIOS policy, leading to a kernel crash.

Why it matters to the business

Unexpected system instability or reboot on Linux systems using affected WiFi 7 hardware when 6 GHz operation is disabled at the firmware/BIOS level, increasing downtime risk in environments with recent kernel versions before the fix.

How an attack unfolds

An attacker with local access or the ability to trigger WiFi scanning operations on a system with the vulnerable rtw89 driver and 6 GHz blocked by BIOS causes the kernel to dereference a NULL sband pointer during scan offload, resulting in a crash.

How to fix it

Upgrade to Linux kernel 6.9.9 or later, or apply the fix from commit ce4ba62f8bc5195a9a0d49c6235a9c99e619cadc in the stable tree. Rebuild and deploy the updated kernel on all affected systems; test WiFi functionality after reboot.

How to confirm the fix worked

Confirm the running kernel version is 6.9.9 or newer, or verify the presence of the NULL check for sband in the rtw89 scan offload code path via source inspection or binary diffing of the driver module.

Typical attack path

1. Identify target system running vulnerable Linux kernel with rtw89 WiFi driver and BIOS 6 GHz disable policy
2. Trigger WiFi scan or connect operations that invoke the scan offload firmware command
3. Driver passes NULL 6 GHz sband to the scan handling routine without a check
4. Kernel dereferences the NULL pointer and crashes

How to detect it

Review kernel logs for oops or panic entries referencing rtw89 scan offload or 6 GHz sband around the time of unexpected reboots; correlate with WiFi scan events in system logs.

What your security team should do

• Prioritize kernel updates on systems with rtw89 WiFi hardware within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Disable 6 GHz WiFi in BIOS only after confirming the patch is applied if stability is critical