CVE-2024-47721

What it actually does

Out-of-bounds read in the rtw89 Wi-Fi driver caused by a mismatch between the number of implemented C2H event handlers and the expected NUM_OF_RTW89_MAC_C2H_FUNC_WOW count after an unused event ID was left in the table.

Why it matters to the business

On systems using affected Realtek Wi-Fi hardware, the flaw can cause kernel memory corruption, leading to crashes, denial of service, or limited information disclosure; widespread Linux kernel deployments increase operational risk but low EPSS and absence from KEV indicate limited real-world exploitation to date.

How an attack unfolds

An attacker with the ability to trigger or emulate the RTW89_MAC_C2H_FUNC_READ_WOW_CAM firmware C2H event causes the driver to index past the end of the handler array, performing an out-of-bounds read; listed threat actors have targeted similar Linux kernel out-of-bounds issues in espionage and financially motivated campaigns.

How to fix it

Update the Linux kernel to the fixed commit 10463308b9454f534d03300cf679bc4b3d078f46 or later stable releases that remove the unused RTW89_MAC_C2H_FUNC_READ_WOW_CAM ID.

How to confirm the fix worked

Confirm the presence of commit 10463308b9454f534d03300cf679bc4b3d078f46 in the kernel source tree; verify that NUM_OF_RTW89_MAC_C2H_FUNC_WOW matches the actual handler count and that the unused ID is absent from the event table.

Typical attack path

1. Obtain local or firmware-level access to the rtw89 driver
2. Trigger or spoof the unimplemented RTW89_MAC_C2H_FUNC_READ_WOW_CAM C2H event
3. Driver performs out-of-bounds array access during event dispatch
4. Read kernel memory beyond handler table bounds

How to detect it

Review kernel logs for rtw89 driver oops or out-of-bounds warnings; inspect firmware C2H event dispatch paths for evidence of the removed handler; correlate with threat actor activity targeting similar Linux kernel memory issues.

What your security team should do

• Prioritize kernel upgrades on systems with rtw89 hardware
• Monitor for downstream Linux distributions shipping the fixed commit
• Apply vendor kernel updates as they become available