CVE-2024-47713

What it actually does

The vulnerability allows ieee80211_do_stop() to invoke __dev_queue_xmit() while interrupts are disabled due to holding queue_stop_reason_lock, triggering a softirq enable warning in __local_bh_enable_ip and potential skb reclamation races.

Why it matters to the business

Linux systems using WiFi may experience kernel warnings, reduced stability during interface shutdown, or availability issues in wireless networking under load or specific stop conditions.

How an attack unfolds

An attacker with local access triggers ieee80211_do_stop() under conditions that combine spin_lock_irqsave with subsequent skb free paths calling into netlink and dev_queue_xmit, violating IRQ enablement requirements; listed threat actors in Linux kernel campaigns could combine this with other primitives for denial of service.

How to fix it

Update the Linux kernel to the fixed commit 07eb0bd7b0a8abed9d45e0f567c9af1dc83e5268 or later stable releases containing the two-phase skb reclamation change in ieee80211_do_stop().

How to confirm the fix worked

Verify kernel source or running version includes the two-phase reclamation logic; reproduce the syzbot reproducer and confirm absence of the __local_bh_enable_ip warning.

Typical attack path

1. Obtain local code execution or user privileges on affected Linux system
2. Trigger WiFi interface stop or reconfiguration via mac80211
3. Force concurrent skb reclamation while interrupts disabled
4. Observe or amplify softirq warning leading to instability

How to detect it

Search kernel logs and dmesg for the WARNING at kernel/softirq.c involving __local_bh_enable_ip triggered during ieee80211_do_stop or cfg80211_mgmt_tx_status paths.

• WARNING: CPU:.*PID:.*at kernel/softirq.c:.* __local_bh_enable_ip
• ieee80211_do_stop.*spin_lock_irqsave.*queue_stop_reason_lock
• cfg80211_mgmt_tx_status_ext.*__dev_queue_xmit

What your security team should do

• Apply the kernel patch or upgrade to a fixed release immediately on all affected systems
• Monitor for the softirq warning in dmesg and kernel logs
• Prioritize systems with WiFi enabled and high network churn