CVE-2024-46860

What it actually does

NULL pointer dereference in mt7921_ipv6_addr_change notifier when mvif->phy is already NULL on WiFi disable, causing invalid memory access in the Linux kernel mt76 driver.

Why it matters to the business

Affected Linux systems using mt7921 hardware may crash or become unstable when WiFi is disabled, leading to downtime, lost productivity, and potential data loss on servers or endpoints with high ecosystem prevalence in kernel-dependent environments.

How an attack unfolds

An attacker triggers the IPv6 address change notifier by disabling WiFi on vulnerable mt7921 hardware, dereferencing a NULL phy pointer to induce a kernel crash; 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors have targeted similar Linux kernel memory issues for denial of service.

How to fix it

Update the Linux kernel to commit 4bfee9346d8c17d928ef6da2b8bffab88fa2a553 or later; for github.com/clastix/capsule-proxy update to version 0.2.1. Reboot after patching and test WiFi disable operations.

How to confirm the fix worked

Verify kernel source contains the fix commit 4bfee9346d8c17d928ef6da2b8bffab88fa2a553; reproduce WiFi disable sequence and confirm no NULL pointer dereference in mt7921_ipv6_addr_change; check dmesg for absence of related oops.

Typical attack path

1. Obtain local user access on target system
2. Disable WiFi interface to invoke mt7921_ipv6_addr_change notifier
3. Trigger NULL dereference in mvif->phy access
4. Cause kernel panic or oops for denial of service

How to detect it

Search kernel logs and dmesg for oops/panic entries referencing mt7921_ipv6_addr_change or NULL pointer dereference during WiFi disable events; correlate with mt76 driver activity and IPv6 notifier callbacks.

• mt7921_ipv6_addr_change
• mvif->phy
• NULL pointer access in mt7921

What your security team should do

• Prioritize kernel upgrade to fixed commit 4bfee9346d8c17d928ef6da2b8bffab88fa2a553 on all mt7921 systems within 48 hours
• Monitor EPSS trend and threat actor activity for escalation
• Test WiFi disable paths in staging before production rollout
• Review logs for mt76 driver crashes as interim detection