CVE-2024-47724

What it actually does

The vulnerability causes a sleeping function (ath11k_wmi_cmd_send) to be invoked from within RCU read-side critical sections in ath11k_bcn_tx_status_event, violating atomic context rules and risking kernel crashes or deadlocks during beacon template processing for P2P and BSS color change scenarios.

Why it matters to the business

Systems using affected ath11k WiFi hardware may experience unexpected kernel instability or reboots under normal wireless operation, leading to loss of network connectivity and potential downtime for dependent services until the kernel is updated.

How an attack unfolds

An attacker with local or adjacent network access triggers repeated beacon transmission status events on an ath11k device; the event handler acquires an RCU lock and then calls a might-sleep WMI command, violating atomic context and causing a kernel panic or oops that can be leveraged for denial of service or, in combination with other primitives, further exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit dbd51da69dda1137723b8f66460bf99a9dac8dd2 or later; apply the stable-tree patch that moves beacon tx event handling to a work queue and verify the fix with cancel_work_sync protection.

How to confirm the fix worked

Confirm the running kernel git commit or package version includes dbd51da69dda1137723b8f66460bf99a9dac8dd2; reproduce beacon tx events in a test environment and ensure no sleeping-in-atomic warnings appear in dmesg or Smatch output.

Typical attack path

1. Obtain local or adjacent network presence on a system using ath11k WiFi
2. Trigger or manipulate P2P GO or BSS color change beacon events
3. Cause ath11k_bcn_tx_status_event to execute under RCU read lock
4. Induce the sleeping WMI command call to panic the kernel

How to detect it

Search kernel logs and dmesg for warnings or oops mentioning ath11k_wmi_p2p_go_bcn_ie, sleeping in atomic context, or RCU usage violations around beacon tx events; correlate with ath11k driver activity and recent P2P or BSS color change operations.

What your security team should do

• Prioritize kernel updates on all systems exposing ath11k WiFi interfaces
• Monitor for related kernel oops or RCU warnings in production logs
• Apply the fix in custom or downstream kernels within the next maintenance window
• Review wireless driver usage in high-availability environments for additional hardening