CVE-2024-43879: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-43879 affects the Linux kernel's wifi subsystem, specifically in the cfg80211 component. The vulnerability was discovered and disclosed on August 20, 2024, and involves an unhandled 2x996 RU allocation in the cfg80211_calculate_bitrate_he() function. This issue affects various Linux kernel versions that implement the cfg80211 wireless networking subsystem (NVD).

The vulnerability stems from the cfg80211_calculate_bitrate_he() function not properly handling the NL80211_RATE_INFO_HE_RU_ALLOC_2x996 allocation, which leads to warning messages: 'kernel: invalid HE MCS: bw:6, ru:6' and 'kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501'. The issue was traced back to the original commit that added HE support (c4cbaf7973a7 'cfg80211: Add support for HE') (Kernel Commit).

The vulnerability results in incorrect handling of 2x996 RU allocation in WiFi communications, potentially affecting wireless network performance and stability. The issue manifests as kernel warnings and may impact systems using the affected cfg80211 wireless networking subsystem (Red Hat).

The vulnerability has been assessed as having low severity with local access required. There are no known exploits in the wild, and the issue primarily affects system stability rather than security (Red Hat).

A fix has been implemented that handles the 2x996 RU allocation in the same way as 160 MHz bandwidth. The patch has been merged into various kernel versions and is available through distribution updates. Ubuntu has released fixes for multiple kernel versions including 6.8.0-50.51 for 24.04 LTS and 5.15.0-125.135 for 22.04 LTS (Ubuntu).