Security readout for executives and security teams
Plain-English summary
CVE-2024-40912 is a Linux kernel Wi-Fi mac80211 locking bug. Under power-save wakeup handling, the kernel can deadlock itself and trigger RCU stalls, disrupting wireless networking or the host. The sources do not provide CVSS, privilege requirements, or active exploitation evidence, so urgency depends on whether affected Linux kernels with mac80211 Wi-Fi are deployed.
Executive priority
Treat this as an availability risk for Linux Wi-Fi and embedded/OT environments. It is not marked as exploited in KEV, and severity data is missing, but deadlocks in kernel networking can cause operational disruption. Prioritize patch verification where wireless Linux systems support business or plant operations.
Technical view
The bug is in ieee80211_sta_ps_deliver_wakeup(): it used spin_lock while synchronizing with softirq-context ieee80211_tx_h_unicast_ps_buf(). A softirq on the same CPU could attempt the same sta->ps_lock, causing deadlock. The upstream fix uses spin_lock_bh()/spin_unlock_bh() to block softirqs while holding the lock.
Likely exposure
Exposure is most relevant to Linux systems using affected kernel versions with mac80211-based Wi-Fi. The bundle lists Linux 3.14 through 6.10 and several stable commits as affected context, with Debian LTS and Siemens advisories referenced. Systems without Wi-Fi/mac80211 use are less likely to be exposed.
Exploitation context
The provided bundle does not show active exploitation, KEV inclusion, proof-of-concept availability, or attacker prerequisites. The described outcome is a kernel deadlock/RCU stall, indicating availability impact rather than confirmed code execution or data exposure.
Researcher notes
Evidence supports a local kernel synchronization flaw in mac80211 power-save wakeup handling. The source bundle includes the failure trace and fix rationale but lacks CVSS, CWE, exploitability details, and confirmed affected downstream products beyond referenced advisories. Avoid assuming remote triggerability without vendor or researcher evidence.
Mitigation direction
- Apply Linux kernel stable updates containing the referenced mac80211 fix.
- Check Debian, Siemens, or other vendor advisories for supported package updates.
- Prioritize systems using Wi-Fi, embedded Linux, or operational technology appliances.
- Where patching is delayed, assess whether affected Wi-Fi functionality can be reduced.
- Track vendor guidance because no standalone workaround is named in the bundle.
Validation and detection
- Inventory Linux kernel versions across Wi-Fi-capable systems and appliances.
- Confirm whether mac80211-based wireless drivers are enabled or loaded.
- Compare deployed kernels against vendor fixed releases and referenced stable commits.
- Review logs for RCU stalls or deadlock symptoms around wireless power-save activity.
- Verify patched systems include the spin_lock_bh locking change.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit e51637e0c66a
- Linux stable commit 28ba44d680a3
- Linux stable commit e7e916d693dc
- Linux stable commit d90bdff79f8e
- Linux stable commit 9c49b58b9a2b
- Linux stable commit 456bbb8a31e4
- Linux stable commit 47d176755d5c
- Linux stable commit 44c06bbde644
- Debian LTS announcement
- Siemens ProductCERT SSA-265688
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40912 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e51637e0c66a6f72d134d9f95daa47ea62b43c7eCVE reference, Linux
- https://git.kernel.org/stable/c/28ba44d680a30c51cf485a2f5a3b680e66ed3932CVE reference, Linux
- https://git.kernel.org/stable/c/e7e916d693dcb5a297f40312600a82475f2e63bcCVE reference, Linux
- https://git.kernel.org/stable/c/d90bdff79f8e40adf889b5408bfcf521528b169fCVE reference, Linux
- https://git.kernel.org/stable/c/9c49b58b9a2bed707e7638576e54c4bccd97b9ebCVE reference, Linux
- https://git.kernel.org/stable/c/456bbb8a31e425177dc0e8d4f98728a560c20e81CVE reference, Linux
- https://git.kernel.org/stable/c/47d176755d5c0baf284eff039560f8c1ba0ea485CVE reference, Linux
- https://git.kernel.org/stable/c/44c06bbde6443de206b30f513100b5670b23fc5eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-355557.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.