CVE-2024-43912

What it actually does

The vulnerability permitted nl80211 to accept unsupported special AP channel widths such as S1G or narrow channels instead of restricting configuration to the normal 20/40/... MHz progression, allowing invalid wireless interface state to reach the kernel.

Why it matters to the business

Linux-based wireless access points or routers could experience instability, crashes, or degraded wireless operation when an attacker or misbehaving client attempts to set disallowed channel widths, leading to service outages and unplanned maintenance.

How an attack unfolds

An attacker with the ability to invoke nl80211 commands (local or via a compromised management process) submits a crafted AP channel width request containing S1G or narrow-channel values; the kernel previously accepted the request, resulting in invalid internal state that can be abused for denial of service or further kernel-level impact.

How to fix it

Upgrade the Linux kernel to a version containing commit 3d42f2125f6c89e1e71c87b9f23412afddbba45e (or the corresponding stable backport) which adds the explicit disallowance of special AP channel widths.

How to confirm the fix worked

Confirm the patch by inspecting the nl80211 source for the added channel-width validation check; test by attempting to configure an AP with S1G/narrow widths and verifying the operation is now rejected with an appropriate error.

Typical attack path

1. Gain local execution context or compromise a process with CAP_NET_ADMIN
2. Issue nl80211 AP configuration command specifying disallowed channel width
3. Trigger kernel path that mishandles the invalid width, causing crash or resource misuse

How to detect it

Review kernel logs (dmesg, syslog) for nl80211 or mac80211 errors during AP setup; inspect audit logs for unusual NET_ADMIN capability use or wireless configuration attempts around the time of any observed instability.

What your security team should do

• Prioritize kernel updates on all WiFi-enabled Linux systems within the next maintenance window
• Restrict CAP_NET_ADMIN and nl80211 access to only trusted management processes
• Monitor vendor advisories for distribution-specific backports of the fix