Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver flaw can crash the operating system when a specific recovery event occurs during wake-from-sleep with Wake-on-WLAN. The driver may register the same network interface twice, triggering a kernel panic. This primarily threatens availability on systems using affected rtw89 wireless hardware and the relevant power-management flow.
Executive priority
Treat this as a high-priority endpoint stability issue where rtw89 Wi-Fi and sleep-resume features are used. Accelerate supported kernel updates for exposed fleets, especially systems where unexpected reboots disrupt operations. The evidence does not establish active exploitation or demonstrated data compromise.
Technical view
During WoWLAN resume, an rtw89 SER L2 recovery can invoke ieee80211_reconfig(). If rtw89_wow_resume() then fails, interface addition may run again. The duplicate list insertion triggers Linux list-debug protection and a kernel panic in rtw89_ops_add_interface. Stable-kernel commits add a check preventing the duplicate insertion.
Likely exposure
Exposure requires an affected Linux kernel, an rtw89-supported wireless device, and the relevant SER L2 event during WoWLAN resume. The bundle lists affected Linux versions but does not provide sufficiently clear range semantics for reliable version-only screening. Distribution backports may also change exposure.
Exploitation context
The supplied record has a CVSS 3.1 score of 8.8 with adjacent-network access, low complexity, no privileges, and no user interaction. However, the technical description demonstrates a kernel panic, not confidentiality or integrity compromise. The CVE is not listed as KEV, and the bundle provides no evidence of active exploitation.
Researcher notes
The failure is a duplicate linked-list insertion in the rtw89 interface-add path following overlapping recovery and resume reconfiguration. The supplied crash trace supports reproducible denial of service. CVSS claims high confidentiality, integrity, and availability impact, but the narrative evidence directly substantiates only kernel panic and availability loss.
Mitigation direction
- Install a vendor-supported kernel containing the applicable linked stable-kernel fix.
- Check distribution advisories because vendors may backport fixes without changing to an obvious upstream version.
- Prioritize affected laptops and endpoints using rtw89 wireless hardware and WoWLAN.
- If updating is delayed, request vendor-approved mitigation guidance; the supplied sources name no workaround.
Validation and detection
- Inventory kernel versions, distribution builds, rtw89 modules, compatible wireless hardware, and WoWLAN usage.
- Confirm the installed kernel includes the applicable stable fix or documented distribution backport.
- Review kernel logs for duplicate list-add errors, rtw89_ops_add_interface, ieee80211_reconfig, or resume-related panics.
- After updating, test suspend and WoWLAN resume under change control and confirm the panic does not recur.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49939 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b04650b5a9990cf5c0de480e62c68199f1396a04CVE reference, Linux
- https://git.kernel.org/stable/c/fdc73f2cfbe897f4733156df211d79ced649b23cCVE reference, Linux
- https://git.kernel.org/stable/c/37c319503023de49a4c87301c8998c8d928112cbCVE reference, Linux
- https://git.kernel.org/stable/c/490eddc836b2a6ec286e5df14bed4c7cf5e1f475CVE reference, Linux
- https://git.kernel.org/stable/c/7dd5d2514a8ea58f12096e888b0bd050d7eae20aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.