CVE-2024-49938

What it actually does

skb_trim sanity check on uninitialized skb length in ath9k_hif_usb_reg_in_cb and ath9k_hif_usb_rx_cb error paths allows memory corruption or crash instead of clean reset to zero length before URB resubmit.

Why it matters to the business

Localized denial of service on systems using ath9k_htc USB Wi-Fi adapters, leading to availability loss; low EPSS and no KEV status indicate limited real-world risk, though listed threat actors targeting similar Linux kernel issues increase monitoring priority.

How an attack unfolds

An attacker triggers error paths in the ath9k_htc USB receive callbacks (via crafted USB device responses or fuzzing-like conditions) so that skb_trim operates on an skb with invalid existing length; the 2024 Zero-Day Exploitation Campaigns and Linux kernel OOB access actors could adapt this for local DoS or further corruption.

How to fix it

Apply the upstream fix replacing skb_trim with __skb_set_length(skb, 0) and removing redundant skb_reset_tail_pointer call; for listed Puma packages upgrade to 4.3.4 or 3.12.5 where applicable, though primary fix is Linux kernel patch post-2024-10-21.

How to confirm the fix worked

Confirm kernel source contains __skb_set_length(skb, 0) in both ath9k_hif_usb callbacks and absence of skb_trim; test by reproducing syzbot-reported error paths with USB device emulation.

Typical attack path

1. Gain local access or attach malicious USB Wi-Fi hardware
2. Force error condition in ath9k_hif_usb_reg_in_cb or ath9k_hif_usb_rx_cb
3. Trigger skb_trim on uninitialized skb length
4. Cause kernel memory corruption or panic on resubmit

How to detect it

Search kernel logs and USB subsystem traces for ath9k_hif_usb_reg_in_cb or ath9k_hif_usb_rx_cb entries followed by skb length sanity warnings or oops; correlate with 2024 Zero-Day Exploitation Campaigns and Linux kernel OOB access patterns listed in threat intel.

• ath9k_hif_usb_reg_in_cb.*skb_trim
• ath9k_hif_usb_rx_cb.*skb_trim
• uninitialised skb length

What your security team should do

• Prioritize kernel upgrade on systems with ath9k_htc hardware within 30 days given 737 days since publication
• Monitor for similar uninitialized skb patterns in other USB wifi drivers
• Review logs for ath9k_hif_usb callback crashes as baseline