CVE-2024-56607: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56607 affects the Linux kernel's WiFi subsystem, specifically the ath12k driver's bitrate mask setting functionality. The vulnerability was discovered and disclosed on December 27, 2024, and affects the ath12kmacopsetbitrate_mask() function in the Linux kernel's wireless networking code (Kernel Commit).

The vulnerability stems from an invalid context error in the ath12kmacopsetbitrate_mask() function when attempting to set bitrates using the command 'iw wlan0 set bitrates legacy-2.4 1'. The issue occurs due to improper atomic calls, where the function attempts to sleep in an invalid context at drivers/net/wireless/ath/ath12k/wmi.c:420. The bug manifests when the system holds three specific locks while attempting operations that cannot be performed in atomic context (Kernel Commit).

The vulnerability can cause system instability when users attempt to manually set WiFi bitrates on affected systems. This particularly affects systems using the ath12k driver, with specific issues noted on the WCN6855 firmware which may crash during these operations (Kernel Commit).

The issue has been fixed by switching to use the recently introduced ieee80211iteratestationsmtx() function instead of the atomic version. The fix involves replacing calls to ieee80211iteratestationsatomic() with ieee80211iteratestations_mtx() (Kernel Commit).