CVE-2024-50235

What it actually does

Double-free of wdev->cqm_config memory in cfg80211 when a wireless device is unregistered and later re-registered in a different network namespace, allowing kernel memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, denial of service, or potential code execution, disrupting WiFi-dependent services and requiring urgent kernel updates across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access on a Linux system manipulates wireless device registration across network namespaces to trigger the double-free condition during cfg80211 cleanup, leading to memory corruption that can be leveraged for privilege escalation or system instability.

How to fix it

Upgrade the Linux kernel to a version containing commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; rebuild and reboot with the patched kernel; disable unnecessary WiFi interfaces if immediate patching is not possible.

How to confirm the fix worked

Confirm the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa by checking git log or kernel version; verify wdev pointer clearing logic is present in cfg80211 code; test namespace registration/unregistration sequences do not cause double-free.

Typical attack path

1. Obtain local user access on target Linux system
2. Create or move a wireless netdev across network namespaces
3. Trigger repeated unregister/register cycles on the wdev
4. Trigger the double-free during subsequent destruction
5. Exploit resulting memory corruption for code execution or DoS

How to detect it

Review kernel logs for double-free warnings or oops messages related to cfg80211 and wdev during netdev unregister or namespace operations; inspect dmesg and audit logs for wireless device registration events preceding crashes.

What your security team should do

• Apply the kernel patch containing ffc253263a1375a65fa6c9f62a893e9767fbebfa immediately on all affected systems
• Prioritize updates for systems exposing WiFi in multi-namespace or containerized environments
• Monitor kernel changelogs for related wireless fixes
• Restrict local user access on systems where patching is delayed