CVE-2024-26896: wifi: wfx: fix memory leak when starting AP
In the Linux kernel, the following vulnerability has been resolved:
wifi: wfx: fix memory leak when starting AP
Kmemleak reported this error:
unreferenced object 0xd73d1180 (size 184): comm "wpasupplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [<5ca11420>] kmemcachealloc+0x20c/0x5ac [<127bdd74>] allocskb+0x144/0x170 [<fb8a5e38>] netdevallocskb+0x50/0x180 [<0f9fa1d5>] ieee80211beaconget+0x290/0x4d4 [mac80211] [<7accd02d>] ieee80211beacongettim+0x54/0x18c [mac80211] [<41e25cc3>] wfxstartap+0xc8/0x234 [wfx] [<93a70356>] ieee80211startap+0x404/0x6b4 [mac80211] [<a4a661cd>] nl80211startap+0x76c/0x9e0 [cfg80211] [<47bd8b68>] genlrcvmsg+0x198/0x378 [<453ef796>] netlinkrcvskb+0xd0/0x130 [<6b7c977a>] genlrcv+0x34/0x44 [<66b2d04d>] netlinkunicast+0x1b4/0x258 [<f965b9b6>] netlinksendmsg+0x1e8/0x428 [<aadb8231>] syssendmsg+0x1e0/0x274 [<d2b5212d>] syssendmsg+0x80/0xb4 [<69954f45>] syssendmsg+0x64/0xa8 unreferenced object 0xce087000 (size 1024): comm "wpasupplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<9a993714>] kmalloctrackcaller+0x230/0x600 [<f83ea192>] kmallocreserve.constprop.0+0x30/0x74 [<a2c61343>] allocskb+0xa0/0x170 [<fb8a5e38>] netdevallocskb+0x50/0x180 [<0f9fa1d5>] ieee80211beaconget+0x290/0x4d4 [mac80211] [<7accd02d>] ieee80211beacongettim+0x54/0x18c [mac80211] [<41e25cc3>] wfxstartap+0xc8/0x234 [wfx] [<93a70356>] ieee80211startap+0x404/0x6b4 [mac80211] [<a4a661cd>] nl80211startap+0x76c/0x9e0 [cfg80211] [<47bd8b68>] genlrcvmsg+0x198/0x378 [<453ef796>] netlinkrcvskb+0xd0/0x130 [<6b7c977a>] genlrcv+0x34/0x44 [<66b2d04d>] netlinkunicast+0x1b4/0x258 [<f965b9b6>] netlinksendmsg+0x1e8/0x428 [<aadb8231>] syssendmsg+0x1e0/0x274 [<d2b5212d>] syssendmsg+0x80/0xb4
However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfxsetmfpap(). The issue is obvious in this function: memory allocated by ieee80211beaconget() is never released. Fixing this leak makes kmemleak happy.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26896?
CVE-2024-26896 is categorized as a medium-severity vulnerability in the Linux kernel affecting Wi-Fi functionality.
How do I fix CVE-2024-26896?
To fix CVE-2024-26896, update your Linux kernel to versions 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-26896?
CVE-2024-26896 affects Debian-based systems with Linux kernel versions up to and including 5.10.226-1.
What does CVE-2024-26896 exploit?
CVE-2024-26896 exploits a memory leak vulnerability when starting an access point (AP) in the Linux kernel's Wi-Fi subsystem.
Is CVE-2024-26896 actively being exploited?
As of now, there are no public reports indicating that CVE-2024-26896 is being actively exploited in the wild.