CVE-2024-49857: wifi: iwlwifi: mvm: set the cipher for secured NDP ranging

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-21 · updated 2026-08-04
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: set the cipher for secured NDP ranging The cipher pointer is not set, but is derefereced trying to set its content, which leads to a NULL pointer dereference. Fix it by pointing to the cipher parameter before dereferencing.

Affected products

Linux kernel: from 6.11 before 6.11.2 — fixed in 6.11.2

How to fix

Upgrade to a fixed version: Linux kernel 6.11.2. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/a949075d4bbf1ca83ccdeaa6ef4ac2ce7526c5f4
https://git.kernel.org/stable/c/b3322a6d6aa9bc17b395c4b38d3b97578887aa8a

Get alerted when CVE-2024-49857 or the next vulnerability affects your stack