Security readout for executives and security teams
Plain-English summary
CVE-2024-58064 is a Linux kernel NULL pointer dereference in a cfg80211 Wi-Fi KUnit test path. The reported impact is availability only, requiring local low-privileged access. The evidence points to test code rather than an exposed network service, so urgency is moderate and mainly affects kernel builds or environments that include or run these tests.
Executive priority
Treat this as a moderate availability issue, not an emergency remote compromise signal. Patch through normal kernel maintenance, with faster handling for shared development, CI, or research systems where local users can run kernel test paths.
Technical view
kunit_kzalloc() may return NULL in test_cfg80211_parse_colocated_ap(), and the test code dereferenced the returned ies pointer without checking it. The fix adds a NULL check. CVSS 3.1 is 5.5: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. CWE-476 applies.
Likely exposure
Exposure is most plausible on Linux kernels or source trees matching the affected versions and commits listed in the CVE data. The bundle names Linux kernel versions 6.9, 6.12.13, 6.13.2, and 6.14, but distribution-specific package status is not provided.
Exploitation context
No active exploitation is cited, and the CVE is not marked KEV. The access vector is local with low privileges. The source bundle does not show a production runtime trigger or remote attack path, and identifies the vulnerable function as test code.
Researcher notes
The public evidence is narrow: a NULL dereference in cfg80211 KUnit test code with stable kernel commits. Do not assume remote Wi-Fi exploitation or broader cfg80211 runtime exposure without additional vendor evidence.
Mitigation direction
- Apply Linux kernel updates that include the referenced stable fixes.
- Check your Linux distribution advisories for package-specific fixed versions.
- Prioritize systems where local users can run kernel tests or custom kernels.
- If updates are unavailable, follow vendor guidance rather than using ad hoc fixes.
Validation and detection
- Inventory kernel versions and source commits against the CVE affected data.
- Confirm the cfg80211 KUnit test includes a NULL check after kunit_kzalloc().
- Verify distribution kernel packages include one of the referenced stable commits.
- Review whether KUnit test code is built or runnable in your environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58064 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/886271409603956edd09df229dde7442c410a872CVE reference, Linux
- https://git.kernel.org/stable/c/0d17d81143f5aa56ee87e60bb1000a2372a0ada8CVE reference, Linux
- https://git.kernel.org/stable/c/13c4f7714c6a1ecf748a2f22099447c14fe6ed8cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.