CVE-2024-35938 is a vulnerability identified in the Linux kernel's ath11k wireless driver, specifically related to the MHI (Modem Host Interface) channel buffer length configuration for Qualcomm chipsets such as QCA6390 and WCN6855. The vulnerability arises because the buf_len field in the ath11k_mhi_config_qca6390 structure was set to zero, causing the MHI subsystem to default to allocating 64KB buffers for channel communication. This large buffer allocation can fail in scenarios where system memory is highly fragmented and memory compaction or reclaim is restricted, leading to page allocation failures and kernel warnings or errors. The failure is exemplified by kernel logs showing allocation failures with GFP_NOIO and __GFP_COMP flags, indicating that memory allocation requests for order 4 pages (64KB) are unsuccessful under certain conditions. These buffers are used exclusively for QMI (Qualcomm MSM Interface) target-to-host communication, and the largest packet size for these communications is less than 6KB. The fix involves reducing the buffer length to 8KB, which corresponds to an order 1 allocation (two contiguous 4KB pages), significantly reducing the likelihood of allocation failure in fragmented memory environments. This change optimizes memory usage and improves stability for affected wireless drivers on Linux systems using these Qualcomm chipsets. The vulnerability does not appear to have known exploits in the wild and was tested on specific hardware versions such as WCN6855 hw2.0. No CVSS score has been assigned yet, but the issue is primarily a stability and availability concern rather than a direct confidentiality or integrity compromise. The vulnerability affects Linux kernel versions containing the specified commit hashes and is relevant for systems running these Qualcomm wireless chipsets with the ath11k driver.

For European organizations, the impact of CVE-2024-35938 primarily concerns system stability and availability of Linux-based devices using Qualcomm ath11k wireless chipsets, particularly QCA6390 and WCN6855. Organizations relying on Linux servers, embedded systems, or network infrastructure with these wireless components may experience kernel page allocation failures leading to degraded wireless performance, intermittent connectivity issues, or kernel warnings that could escalate to system instability or crashes under memory pressure conditions. This could affect critical infrastructure, enterprise wireless networks, and IoT deployments that utilize these chipsets. While the vulnerability does not directly expose data confidentiality or integrity, the resulting instability could disrupt business operations, especially in environments where wireless connectivity is essential. Additionally, failure to address this vulnerability could complicate incident response and system maintenance due to unpredictable kernel behavior. The absence of known exploits reduces immediate risk, but the potential for denial-of-service-like conditions through resource exhaustion warrants prompt remediation in production environments.

European organizations should prioritize updating their Linux kernels to versions that include the patch reducing the MHI channel buffer length from 64KB to 8KB for the ath11k driver. This update mitigates the risk of memory allocation failures under fragmented memory conditions. Specifically, organizations should: 1) Identify all systems running Linux kernels with Qualcomm ath11k drivers supporting QCA6390 or WCN6855 chipsets. 2) Apply vendor-supplied kernel updates or patches that address CVE-2024-35938. 3) For custom or embedded Linux distributions, backport the patch to maintain stability. 4) Monitor kernel logs for page allocation failures or related warnings as indicators of memory pressure issues. 5) Optimize system memory management policies to reduce fragmentation, such as tuning memory compaction settings or avoiding disabling memory reclaim where possible. 6) Test wireless functionality post-patch to ensure no regressions in connectivity or performance. 7) Incorporate this vulnerability into vulnerability management and patching workflows to ensure timely remediation. These steps go beyond generic advice by focusing on chipset-specific driver updates, memory management tuning, and proactive monitoring tailored to the nature of the vulnerability.