CVE-2024-53074 wifi: iwlwifi: mvm: don't leak a link on AP removal
A resource leak in the iwlwifi driver prevents restarting the access point on older devices, causing a denial of service for Wi-Fi connectivity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53074?
CVE-2024-53074 is a medium-severity denial of service vulnerability in Linux kernel, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't leak a link on AP removal
Release the link mapping resource in AP removal. This impacted devices that do not support the MLD API (9260 and down). On those devices, we couldn't start the AP again after the AP has been already started and stopped.
Weakness: CWE-772
Which versions are affected by CVE-2024-53074?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53074?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-53074 being exploited?
There is no known exploitation of CVE-2024-53074 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53074, DEBIAN-CVE-2024-53074, GHSA-7ghh-hpqx-6wf8, UBUNTU-CVE-2024-53074.