CVE-2024-53074

What it actually does

Resource leak of link mapping on AP removal in iwlwifi mvm driver for non-MLD devices (9260 and older), preventing subsequent AP start after stop.

Why it matters to the business

Older Intel Wi-Fi hardware loses ability to function as an access point after the first start/stop cycle, causing operational downtime for wireless services on affected Linux systems.

How an attack unfolds

An attacker with local access or control over AP lifecycle events triggers repeated start/stop sequences on impacted hardware, exhausting link resources and denying AP functionality without requiring remote code execution.

How to fix it

Apply kernel patch 70ddf9ce1894c48dbbf10b0de51a95e4fb3dd376 or later stable release; rebuild and deploy updated kernel images to affected devices; test AP mode functionality post-upgrade.

How to confirm the fix worked

Confirm presence of the fix commit in running kernel source; verify AP start/stop cycle completes successfully on 9260 and older hardware; monitor dmesg for link mapping allocation messages.

Typical attack path

1. Identify systems running vulnerable iwlwifi on non-MLD hardware
2. Gain local execution or manage AP interface lifecycle
3. Issue repeated AP start and stop operations
4. Observe failure to restart AP due to leaked link mapping

How to detect it

Review kernel logs for link allocation warnings during AP removal; search dmesg and syslog for iwlwifi mvm link leak messages around AP interface events.

• iwlwifi.*link.*leak
• mvm.*AP removal.*resource
• failed to start AP after stop

What your security team should do

• Prioritize kernel updates on all systems using iwlwifi 9260 and earlier hardware
• Disable AP mode on vulnerable devices until patched if operationally feasible
• Audit wireless interface usage logs for repeated AP start/stop patterns