CVE-2024-46827

What it actually does

Invalid MCS-NSS value in Extended HE Capabilities IE of association request leads to peer_nss=0 being passed to firmware without validation, triggering crash in ath12k driver.

Why it matters to the business

Denial of service on Linux-based wireless access points using affected QCN9274 hardware, causing temporary loss of Wi-Fi connectivity for connected clients; low urgency as not exploited in the wild or ransomware campaigns.

How an attack unfolds

Attacker crafts an association request containing an Extended HE Capabilities element where EHT-PHY indicates bandwidth support but MCS-NSS set is zeroed; the driver derives peer_nss=0 and forwards it, crashing firmware. No named threat actors or widespread campaigns observed exploiting this specific flaw.

How to fix it

Upgrade Linux kernel to the fixed commit 838c2cfdb6be7d7d8c06c711edf893eb34ca2e7c or later releases containing the peer_nss validation check. Reject association requests when peer_nss is zero or invalid before any firmware interaction.

How to confirm the fix worked

Verify kernel source contains the validation step for peer_nss > 0; attempt reproduction with malformed association requests in a lab environment and confirm no firmware crash occurs.

Typical attack path

1. Locate target access point running vulnerable ath12k driver
2. Craft association request with invalid Extended HE Capabilities IE (MCS-NSS zeros)
3. Send request to trigger peer_nss=0 calculation
4. Observe firmware crash on the device

How to detect it

Review ath12k driver and firmware logs for crash events triggered during association processing; correlate with incoming association requests containing Extended HE Capabilities elements.

What your security team should do

• Apply the kernel fix from commit 838c2cfdb6be7d7d8c06c711edf893eb34ca2e7c immediately on affected systems
• Monitor wireless driver logs and firmware health for crash indicators
• Prioritize patching on production access points given ecosystem prevalence of Linux kernel
• Test association handling post-upgrade before full deployment