CVE-2024-47738

What it actually does

The flaw allows incorrect rate mask settings to be applied during offchannel transmissions in mac80211, bypassing validation that would otherwise reject unsupported rate combinations and triggering no-supported-rate warnings.

Why it matters to the business

Linux-based wireless devices may experience intermittent connection issues or kernel warnings during certain transmission scenarios, increasing operational overhead for patching fleets of affected systems with no evidence of active exploitation.

How an attack unfolds

An attacker would need to trigger offchannel transmissions with crafted rate mask configurations that the kernel previously mishandled; however, the low EPSS and absence from KEV indicate no practical end-to-end exploitation path has been observed despite mentions of broad Linux kernel campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to commit 62fb9874f5da54fdb243003b386128037319b219 or later; apply the fix via distribution channels that include this commit.

How to confirm the fix worked

Confirm the running kernel contains commit 62fb9874f5da54fdb243003b386128037319b219; test offchannel TX scenarios to verify absence of the previously reported no-supported-rate warnings.

Typical attack path

1. Identify a Linux system using the affected mac80211 code path
2. Craft wireless frames or configurations that invoke offchannel TX with an empty legacy rate plus HE MCS mask
3. Trigger the condition that bypasses rate validation
4. Observe kernel warnings or degraded transmission behavior

How to detect it

Search kernel logs and wireless subsystem traces for rate mask validation warnings during offchannel activity; correlate with syzbot-style reproducers if available in the environment.

What your security team should do

• Prioritize kernel updates for all Linux wireless endpoints within standard maintenance windows
• Monitor vendor advisories for backported fixes in supported distributions
• Review wireless driver logs for rate-mask-related warnings as a temporary detection measure