CVE-2024-56535

What it actually does

Unchecked kmalloc failure in btc_fw_set_monreg() leads to NULL pointer dereference in the rtw89 WiFi coexistence driver.

Why it matters to the business

Systems running affected Linux kernels may experience WiFi driver crashes or instability, disrupting wireless connectivity and requiring reboots or patches on servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access triggers the btc_fw_set_monreg() path under memory pressure so that kmalloc returns NULL; subsequent dereference causes a kernel oops or panic. No remote or unauthenticated exploitation path is known.

How to fix it

Update the Linux kernel to the commit 051577414271961f3f4c3bff87b427924b486219 or later stable releases that contain the NULL check in btc_fw_set_monreg(). Rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the source of btc_fw_set_monreg() for the added NULL return check after kmalloc; verify the running kernel git commit or package version matches or exceeds the fixed revision.

Typical attack path

1. Obtain local code execution or shell on the target Linux system
2. Induce memory pressure or repeatedly invoke rtw89 coexistence monitor registration
3. Cause kmalloc to fail inside btc_fw_set_monreg()
4. Trigger NULL pointer dereference leading to kernel crash

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing rtw89, coex, or btc_fw_set_monreg around the time of WiFi-related instability.

• NULL pointer dereference in btc_fw_set_monreg
• rtw89.*coex.*kmalloc

What your security team should do

• Apply the referenced kernel commit or distribution update within standard change windows
• Monitor for kernel oops reports referencing rtw89 or btc_fw_set_monreg
• Limit local user access on multi-tenant systems until patched