Security readout for executives and security teams
Plain-English summary
CVE-2024-35946 is a Linux kernel Wi-Fi driver bug. When a Realtek rtw89 scan is cancelled, the kernel could reference the wrong interface and hit a null pointer. The public record does not provide CVSS severity, impact detail, or evidence of active exploitation.
Executive priority
Handle through normal kernel patch management unless affected Wi-Fi-enabled Linux fleets are business-critical or crash-sensitive. There is not enough source evidence to justify emergency treatment.
Technical view
The issue is in the Linux kernel rtw89 Wi-Fi driver scan abort path. During cancel scan, code could use a virtual interface that was not actually scanning. The fix changes the logic to use the actual scanning vif. Kernel stable commits are referenced as the remediation evidence.
Likely exposure
Exposure appears limited to Linux systems using the rtw89 Wi-Fi driver in affected kernel ranges listed by the CVE record. The bundle does not identify specific distributions, devices, or Realtek chip models beyond the driver name.
Exploitation context
CISA KEV status is false in the provided bundle. No cited source claims active exploitation, public exploit availability, remote reachability, or privilege impact. Treat exploitation context as incomplete until vendor advisories add detail.
Researcher notes
Key unknowns are exploitability, user-trigger requirements, crash scope, and affected downstream distribution versions. Analysis should stay tied to rtw89 scan cancellation behavior and the stable kernel fixes; the source bundle does not support broader impact claims.
Mitigation direction
- Apply Linux distribution kernel updates that include the referenced stable fixes.
- If no package is available, monitor vendor guidance for CVE-2024-35946 remediation.
- Prioritize systems that use the Realtek rtw89 Wi-Fi driver.
- Avoid custom kernel backports unless they include the exact scan-abort fix.
Validation and detection
- Inventory Linux hosts where the rtw89 driver is present or loaded.
- Compare running kernel builds with vendor advisories for CVE-2024-35946.
- Check whether kernel updates include the referenced stable commits.
- Review kernel logs for rtw89 scan cancellation crashes during incident triage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35946 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b34d64e9aa5505e3c84570aed5c757f1839573e8CVE reference, Linux
- https://git.kernel.org/stable/c/4f11c741908dab7dd48fa5a986b210d4fc74ca8dCVE reference, Linux
- https://git.kernel.org/stable/c/7e11a2966f51695c0af0b1f976a32d64dee243b2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.