CVE-2024-43879

What it actually does

Unhandled NL80211_RATE_INFO_HE_RU_ALLOC_2x996 case in cfg80211_calculate_bitrate_he() triggers a kernel WARNING for invalid HE MCS when processing 2x996 RU allocations in 802.11ax/HE frames.

Why it matters to the business

Linux systems using Wi-Fi 6/6E hardware may experience kernel warnings or availability impact during normal wireless operation, potentially disrupting connectivity on affected kernels.

How an attack unfolds

An attacker with local access sends or induces wireless frames using 2x996 RU allocation; the unhandled case in the bitrate calculation function logs a warning and may affect driver stability.

How to fix it

Apply the fix from commit 45d20a1c54be4f3173862c7b950d4468447814c9 or upgrade to a kernel containing this commit.

How to confirm the fix worked

Verify the patched cfg80211_calculate_bitrate_he() handles RU allocation 6 identically to 160 MHz bandwidth; confirm absence of the invalid HE MCS warning in dmesg after wireless activity.

Typical attack path

1. Obtain local access to a Linux system with cfg80211
2. Trigger 802.11 HE frame processing with 2x996 RU allocation
3. Invoke cfg80211_calculate_bitrate_he() with unhandled ru:6 value

How to detect it

Search kernel logs and dmesg for strings indicating invalid HE MCS with bw:6 or ru:6 and the cfg80211_calculate_bitrate_he warning.

• invalid HE MCS: bw:6, ru:6
• WARNING: CPU:.*PID:.*at net/wireless/util.c:.*cfg80211_calculate_bitrate_he

What your security team should do

• Prioritize kernel updates containing commit 45d20a1c54be4f3173862c7b950d4468447814c9
• Monitor kernel logs for HE MCS warnings on wireless interfaces
• Test wireless functionality post-update to confirm stability