CVE-2024-49937

What it actually does

In non-AP modes, starting CAC in cfg80211 leaves chandef.chan null, causing a warning in cfg80211_chandef_dfs_usable when CAC completes.

Why it matters to the business

Linux WiFi systems using DFS channels may experience kernel warnings or disrupted wireless operation, increasing maintenance overhead and potential downtime in affected deployments.

How an attack unfolds

An attacker with local access triggers CAC start in a non-AP mode on a DFS channel; the missing channel definition leads to the null pointer condition at CAC end, surfacing the warning via regulatory propagation.

How to fix it

Apply the upstream kernel fix ensuring channel definition is set for all modes when starting CAC; for listed packages upgrade nokogiri to 1.8.1 or later.

How to confirm the fix worked

Confirm kernel build includes the resolved CAC chandef handling; test CAC start/end in non-AP modes and verify absence of the warning.

Typical attack path

1. Obtain local access on Linux system with cfg80211 WiFi
2. Configure interface for non-AP mode on DFS channel
3. Initiate CAC operation
4. Observe warning when CAC completes due to null chan

How to detect it

Search kernel logs for the cfg80211_chandef_dfs_usable warning and traces involving cfg80211_propagate_cac_done_wk or regulatory_propagate_dfs_state.

• cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]
• WARNING: CPU: .* PID: .* at cfg80211_chandef_dfs_usable

What your security team should do

• Prioritize kernel updates on systems with wireless DFS support
• Monitor for cfg80211 warnings in system logs
• Validate post-update CAC behavior in test environments