CVE-2024-48873

What it actually does

Missing NULL check after ieee80211_probereq_get() in rtw89 driver allows potential NULL pointer dereference leading to kernel crash.

Why it matters to the business

Denial of service risk on Linux systems with rtw89 wireless hardware, disrupting network connectivity in servers, embedded devices, and workstations until patched.

How an attack unfolds

Attacker triggers conditions where ieee80211_probereq_get() returns NULL during probe request handling in the rtw89 driver; absent validation causes immediate dereference and kernel panic. No named threat actors or ransomware campaigns associated.

How to fix it

Apply kernel update containing commit 1a0f54cb3fea5d087440b2bae03202c445156a8d in org/pub/scm/linux/kernel/git/stable/linux.git (GIT). Reboot affected systems after upgrade.

How to confirm the fix worked

Confirm presence of the NULL return check in rtw89 source after the ieee80211_probereq_get() call or verify running kernel includes the referenced commit.

Typical attack path

1. Locate Linux host using rtw89 wireless driver
2. Send crafted 802.11 management frames to invoke probe request path
3. Force ieee80211_probereq_get() to return NULL
4. Trigger NULL dereference and induce kernel oops or panic

How to detect it

Search kernel logs and crash dumps for rtw89 NULL pointer dereference messages or oops traces referencing ieee80211_probereq_get.

• rtw89
• ieee80211_probereq_get
• Dereference null return value
• Coverity-ID: 1529805

What your security team should do

• Prioritize kernel upgrades on all rtw89-equipped systems within standard change windows
• Add kernel oops monitoring for rtw89 paths to detect attempted exploitation
• Test patched kernels in lab environments before broad deployment