CVE-2024-26683: wifi: cfg80211: detect stuck ECSA element in probe resp
First published: Tue Apr 02 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we might not be able to connect in time to hear the switching in a beacon. This was in commit c09c4f31998b ("wifi: mac80211: don't connect to an AP while it's in a CSA process"). However, we promptly got a report that this caused new connection failures, and it turns out that the AP that we now cannot connect to is permanently advertising an extended channel switch announcement, even with quiet. The AP in question was an Asus RT-AC53, with firmware 3.0.0.4.380_10760-g21a5898. As a first step, attempt to detect that we're dealing with such a situation, so mac80211 can use this later.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel | ||
| Asus RT-AC53 | ||
| Linux Kernel | >=6.7<6.7.5 | |
| Linux Kernel | =6.8-rc1 | |
| Linux Kernel | =6.8-rc2 | |
| Linux Kernel | =6.8-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26683?
CVE-2024-26683 has a medium severity rating due to its potential impact on wireless connectivity.
How do I fix CVE-2024-26683?
To fix CVE-2024-26683, update the Linux kernel to the latest version that includes the security patch.
What systems are affected by CVE-2024-26683?
CVE-2024-26683 affects the Linux kernel and devices such as the Asus RT-AC53.
What does CVE-2024-26683 exploit?
CVE-2024-26683 exploits a vulnerability related to handling stuck ECSA elements in probe responses during channel switch processes.
How can I determine if my system is vulnerable to CVE-2024-26683?
You can determine vulnerability by checking your running Linux kernel version against the patched versions specified in the security advisory.
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- vendor/linux
- canonical/linux kernel
- vendor/asus
- canonical/asus rt-ac53
- version/linux kernel/6.7
- version/linux kernel/6.8-rc1
- version/linux kernel/6.8-rc2
- version/linux kernel/6.8-rc3