CVE-2024-53055

What it actually does

Infinite loop during 6 GHz scan list construction when the number of colocated APs exceeds 255 because a u8 loop variable cannot reach a u32 count value larger than 255.

Why it matters to the business

Wireless scanning on affected Linux systems can hang indefinitely, leading to loss of Wi-Fi connectivity and potential device unavailability until reboot; high downstream package prevalence increases exposure across many distributions.

How an attack unfolds

An attacker positions or spoofs more than 255 colocated access points visible during 2.4/5 GHz scanning so that the kernel's 6 GHz scan construction enters an unterminating loop; listed espionage and financially motivated actors have targeted similar Linux kernel resource issues in recent campaigns.

How to fix it

Upgrade the Linux kernel to a version containing the fix that changes the loop variable to u32 and reduces its scope; for the listed qemu package on Ubuntu 14.04 LTS apply 2.0.0+dfsg-2ubuntu1.22 or newer.

How to confirm the fix worked

Confirm the kernel source contains the corrected u32 loop variable inside the scan construction loops and that the maximum AP count check prevents overflow; test by injecting a scan result list with >255 colocated APs and verifying the scan completes.

Typical attack path

1. Gain proximity to or control of multiple 6 GHz-capable access points
2. Force or wait for the victim to perform a 2.4/5 GHz scan that discovers >255 colocated APs
3. Trigger 6 GHz scan list construction that enters the infinite u8 loop
4. Cause sustained denial of service on the wireless subsystem

How to detect it

Review kernel logs for repeated or stalled iwlwifi scan messages and dmesg entries around 6 GHz scan construction; correlate with process activity of wpa_supplicant or NetworkManager during Wi-Fi scans.

What your security team should do

• Apply the kernel or qemu package update immediately given the CISA-style remediation urgency implied by publication age
• Monitor wireless scan activity on systems with iwlwifi hardware
• Limit the number of visible access points in test environments to validate the bound