CVE-2024-49929

What it actually does

NULL pointer dereference in iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() when ieee80211_sta pointer passed to iwl_mvm_sta_from_mac80211 is NULL, occurring in the Intel WiFi transmission path of the Linux kernel.

Why it matters to the business

Unexpected crashes on Linux systems with Intel wireless hardware can interrupt operations, cause data loss, and require reboots, increasing maintenance burden especially in environments with many affected devices.

How an attack unfolds

An attacker with local or wireless-adjacent access triggers the vulnerable transmission functions by supplying a NULL sta context, leading to kernel panic; listed threat actors in espionage and financial campaigns have targeted similar Linux kernel memory issues though specific exploitation of this path remains low probability.

How to fix it

Upgrade to fixed kernel versions containing commit cbc6fc9cfcde151ff5eadaefdc6155f99579384f or apply equivalent backports; for Rocky Linux 8 update oniguruma to 6.8.2-2.el8 or later and rebuild dependent packages.

How to confirm the fix worked

Confirm kernel source contains the added sta pointer check before iwl_mvm_sta_from_mac80211 call; test wireless transmission under load with null-station edge cases; verify package versions match listed fixed releases.

Typical attack path

1. Identify Linux system using vulnerable iwlwifi driver
2. Craft or manipulate 80211 station context to NULL during tx path
3. Invoke iwl_mvm_tx_skb_sta or iwl_mvm_tx_mpdu
4. Trigger NULL dereference causing kernel oops or panic

How to detect it

Search kernel logs and dmesg for NULL dereference oops in iwl_mvm_tx paths; inspect crash dumps for references to iwl_mvm_sta_from_mac80211 around wireless tx activity; correlate with threat actor TTPs involving Linux kernel memory corruption.

What your security team should do

• Prioritize patching Linux kernel on all systems with Intel WiFi within 30 days given publication age
• Monitor kernel logs for iwlwifi oops related to tx_skb_sta
• Restrict untrusted local access on multi-user systems until updated
• Review downstream dependents count for ecosystem impact before mass deployment