CVE-2024-57899: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57899 affects the Linux kernel's mac80211 subsystem, specifically related to a flag corruption issue on 32-bit systems. The vulnerability was discovered and disclosed in January 2025, impacting the wifi functionality in the Linux kernel's mesh networking implementation (NVD).

The vulnerability stems from an architectural mismatch where on 32-bit systems, an unsigned long is 4 bytes while a u64 is 8 bytes. When using or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE), the code incorrectly searches for a bit in a 32-bit variable that is expected to be 64 bits in size, leading to incorrect bit finding. This occurs specifically in the mac80211 mesh networking implementation (Kernel Commit).

The vulnerability can lead to flag corruption in the mesh networking functionality on 32-bit systems, potentially causing system instability or incorrect network behavior. The issue specifically affects the mesh BSS (Basic Service Set) changed flags handling in the wireless networking stack (NVD).

The vulnerability requires access to a system running the affected Linux kernel version on a 32-bit architecture. The issue manifests during the handling of mesh networking operations, specifically when processing BSS changed flags (Kernel Commit).

The issue has been resolved through a patch that ensures the size of the bits variable is correctly adjusted for each architecture. The fix involves using BITMAP_FROM_U64 macro to properly handle the 64-bit value on 32-bit systems (Kernel Commit).