CVE-2024-57898

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: clear link ID from bitmap during link delete after clean up

Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the valid_links bitmap. One such example is cfg80211_cac_event(). The flow is -

nl80211_remove_link() cfg80211_remove_link() ieee80211_del_intf_link() ieee80211_vif_set_links() ieee80211_vif_update_links() ieee80211_link_stop() cfg80211_cac_event()

cfg80211_cac_event() requires link ID to be present but it is cleared already in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.

Therefore, clear the link ID from the bitmap only after completing the link clean-up.

This vulnerability is evaluated as having a Moderate impact because exploitation requires local access to manage wireless network interface link states and is limited to triggering a kernel denial of service without compromising data confidentiality or system integrity. In standard Red Hat Enterprise Linux server deployments, wireless hardware and associated cfg80211 subsystems are typically absent or unconfigured. As a result, the issue only affects systems with active Wi-Fi interfaces undergoing link manipulation operations, substantially restricting exposure across enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.