CVE-2024-43844 is a vulnerability identified in the Linux kernel specifically related to the Realtek rtw89 wireless driver, which handles Wi-Fi functionality. The flaw arises in the handling of GTK (Group Temporal Key) offload in the Wake-on-Wireless (WoW) feature, where the driver mistakenly allocates a socket buffer (skb) that is too large, potentially exceeding the skb->end boundary. This causes a kernel panic due to an out-of-bounds memory access, as indicated by the skb_over_panic error and the kernel BUG at net/core/skbuff.c. The vulnerability is triggered during the processing of H2C (Host to Chip) commands related to GTK offload in the rtw89 driver, which is part of the wireless networking stack. The kernel panic leads to a denial of service (DoS) condition, crashing the affected system or causing instability. The detailed kernel stack trace shows the panic occurs in skb_panic, triggered by skb_put when the skb buffer boundaries are violated. The issue affects Linux kernel version 6.6.30-02659-gc18865c4dfbd and likely other versions using the vulnerable rtw89 driver. The vulnerability does not appear to have known exploits in the wild yet, and no CVSS score has been assigned. However, the impact is significant as it can cause system crashes on devices using the affected wireless driver, which is common in many Linux-based systems including laptops, desktops, and embedded devices. The root cause is a programming error in buffer size management within the wireless driver’s WoW GTK offload implementation, which has been fixed by correcting the skb allocation size to prevent overflow.

For European organizations, the impact of CVE-2024-43844 can be substantial, especially for those relying on Linux-based systems with Realtek rtw89 wireless hardware. The vulnerability can cause unexpected system crashes and denial of service, disrupting business operations, network connectivity, and potentially causing data loss or corruption if systems reboot unexpectedly. Organizations with critical infrastructure, enterprise networks, or cloud services running Linux kernels with this driver are at risk of operational downtime. The DoS condition could be exploited by an attacker with local access or potentially via crafted wireless frames if the device processes such packets while in WoW mode. This could affect endpoint devices, servers, or embedded systems in industrial or IoT environments. The disruption of wireless connectivity can degrade productivity and impact remote work capabilities, which are prevalent in Europe. Additionally, the instability caused by kernel panics may complicate incident response and system maintenance. Although no remote code execution or privilege escalation is indicated, the denial of service alone warrants urgent attention to prevent operational impact.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Specifically, they should apply the latest stable kernel releases that include the fix for the rtw89 driver’s GTK offload skb allocation issue. System administrators should audit their environments to identify devices using the rtw89 wireless driver and verify kernel versions. If immediate patching is not feasible, disabling the WoW GTK offload feature or the WoW functionality for the rtw89 device can serve as a temporary mitigation to prevent triggering the vulnerability. Network segmentation and limiting local access to critical Linux systems can reduce the risk of exploitation. Monitoring kernel logs for skb_over_panic or related errors can help detect attempts to trigger the flaw. For embedded or IoT devices, coordinate with vendors to obtain firmware or kernel updates. Additionally, organizations should review wireless device configurations to minimize exposure to untrusted wireless frames, especially in sensitive environments. Implementing robust patch management processes and maintaining up-to-date inventories of Linux kernel versions and wireless drivers will aid in rapid response to such vulnerabilities.