CVE-2024-50237

What it actually does

The flaw allows a stopped virtual interface to be passed to the wireless driver in the get_txpower callback, resulting in the driver operating on uninitialized private data and triggering a kernel crash.

Why it matters to the business

Wireless network interfaces on affected Linux systems can become unstable or cause the entire system to crash, leading to loss of connectivity and unplanned downtime for any workloads relying on Wi-Fi.

How an attack unfolds

An attacker with local access triggers the get_txpower operation on a stopped virtual interface, causing the mac80211 layer to hand uninitialized driver data to the hardware driver and crash the kernel.

How to fix it

Update the Linux kernel to a version containing the fix that prevents stopped virtual interfaces from being passed to the driver in get_txpower; apply the corresponding package updates for your distribution.

How to confirm the fix worked

Confirm the installed kernel version contains the commit that guards the get_txpower path against stopped vifs, then verify that wireless interface stop/start sequences no longer produce crashes or uninitialized memory accesses.

Typical attack path

1. Obtain local user access on a Linux system with the vulnerable mac80211 stack
2. Stop a virtual Wi-Fi interface while keeping the driver loaded
3. Invoke the get_txpower handler through normal wireless management operations or crafted user-space requests
4. Trigger kernel panic due to use of uninitialized driver private data

How to detect it

Review kernel logs for oops or panic messages referencing mac80211 get_txpower or uninitialized data in wireless drivers; correlate with wireless interface state changes in system logs.

What your security team should do

• Prioritize kernel updates on all systems exposing Wi-Fi interfaces
• Monitor vendor advisories for backported fixes in supported LTS kernels
• Restrict local user access on multi-tenant or shared systems until patched