CVE-2024-44997

What it actually does

Use-after-free in mtk_wed driver: cb_priv is freed in mtk_wed_setup_tc_block() without nulling the pointer and mtk_wed_setup_tc_block_cb() performs no null check, leading to invalid memory access and kernel paging fault when multiple AP interfaces on one band with WED enabled are brought down on MT798X.

Why it matters to the business

Kernel panics cause immediate system crashes and reboots on affected MediaTek devices during routine Wi-Fi interface shutdown, resulting in unplanned downtime for wireless services and requiring manual intervention to restore operation.

How an attack unfolds

An attacker or automated process with local privileges brings down one of multiple AP interfaces on a band where WED is active; the missing null check after free allows the callback to dereference freed memory during tcf_block_unbind, triggering the panic.

How to fix it

Apply the upstream fix in commit 326a89321f9d5fe399fe6f9ff7c0fc766582a6a0 (or equivalent stable backports) which nulls cb_priv after free and adds the missing null check; rebuild and deploy updated kernel images to all affected devices.

How to confirm the fix worked

Confirm the running kernel contains commit 326a89321f9d5fe399fe6f9ff7c0fc766582a6a0; reproduce the interface-down scenario with multiple APs and verify no panic occurs; inspect dmesg for absence of mtk_wed_setup_tc_block_cb faults.

Typical attack path

1. Identify host running vulnerable mtk_wed driver with multiple AP interfaces and WED enabled
2. Trigger interface-down event on one AP interface
3. mtk_wed_setup_tc_block frees cb_priv without nulling it
4. mtk_wed_setup_tc_block_cb dereferences the freed pointer during block playback
5. Kernel page fault occurs and system panics

How to detect it

Search kernel logs and crash dumps for the call trace containing mtk_wed_setup_tc_block_cb, tcf_block_playback_offloads and tcf_block_unbind around the time of interface-down events.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all MT798X-based systems
• Add kernel panic monitoring and alerting for mtk_wed call traces
• Test interface management scripts in staging before production rollout
• Disable WED temporarily if immediate patching is not feasible