CVE-2024-43861

What it actually does

Memory leak in the qmi_wwan USB driver when non-IP packets arrive, as the skb is not freed leading to gradual kernel memory exhaustion.

Why it matters to the business

Systems using USB WWAN modems on Linux or Android may experience memory pressure, reduced performance, or crashes after prolonged exposure to non-IP traffic, increasing operational risk in connected devices and embedded deployments.

How an attack unfolds

An attacker with the ability to inject or forward non-IP packets through a USB WWAN interface causes the kernel to allocate skb buffers without releasing them, resulting in resource exhaustion over time; listed threat actors have targeted similar Linux kernel memory issues in espionage and financial campaigns.

How to fix it

Update the Linux kernel to a version containing commit 3c90a69533b5bba73401ef884d033ea49ee99662 or later; for affected Android components update platform/packages/services/Car to the 2021-01-01 release or newer that incorporates the fix.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or a backport, monitor memory usage under non-IP traffic loads, and confirm no skb leaks via slabinfo or kmemleak after applying the update.

Typical attack path

1. Gain network adjacency or control over traffic reaching the qmi_wwan interface
2. Send or induce non-IP packets to the driver
3. Trigger repeated skb allocation without corresponding free operations
4. Observe progressive kernel memory depletion until instability occurs

How to detect it

Review kernel logs and memory statistics for unusual skb allocation growth correlated with qmi_wwan activity; examine dmesg or /proc/slabinfo for patterns of unfreed network buffers after non-IP traffic.

What your security team should do

• Prioritize patching kernel packages on all Linux and Android devices using qmi_wwan
• Review USB WWAN device usage and restrict untrusted packet sources where possible
• Monitor EPSS and KEV status for changes given the low but non-zero exploit probability
• Include the fixed commit in internal kernel build pipelines and regression tests