CVE-2024-27391: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-27391 affects the Linux kernel's wilc1000 WiFi driver. The vulnerability was discovered in January 2024 and stems from a workqueue allocation issue where the wilc_netdev_ifc_init function reallocates a workqueue every time a network interface is added, leading to resource leakage (Kernel Commit).

The issue was introduced by commit 09ed8bfc5215 which moved workqueue creation to wilc_netdev_ifc_init to set interface names in workqueue names. However, since wilc_netdev_ifc_init is called for each interface addition over a physical device, it overwrites the existing workqueue with a new one each time, causing multiple redundant workqueues to be created (Kernel Commit).

The vulnerability results in resource leakage as new workqueues are continuously created without properly cleaning up previous ones. This can be demonstrated by adding and removing interfaces repeatedly, which creates multiple worker processes (Kernel Commit).

The vulnerability requires local access to the system to trigger the issue by adding network interfaces. It appears to primarily impact resource utilization rather than enabling arbitrary code execution or privilege escalation (NVD).

The issue has been fixed by moving the hif_workqueue allocation back to wilc_cfg80211_init and using the wiphy name for the workqueue naming. The patch is included in Linux kernel version 6.8 and has been backported to stable kernel branches (Ubuntu Notice).