Bug 2272846 (CVE-2024-26682)

Summary:	CVE-2024-26682 kernel: wifi: mac80211: improve CSA/ECSA connection refusal
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, sidakwo, sukulkar, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.7.5, kernel 6.8	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Linux kernel, in the handling of CSA and ECSA elements during connection attempts. This issue can lead to network instability issues where certain APs are never connected to because the connection is wrongly blocked.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2272847
Bug Blocks:	2272924

Description Mauro Matteo Cascella 2024-04-03 00:08:56 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: improve CSA/ECSA connection refusal

The Linux kernel CVE team has assigned CVE-2024-26682 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040254-CVE-2024-26682-f2b2@gregkh/T

Comment 1 Mauro Matteo Cascella 2024-04-03 00:09:29 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2272847]

Comment 3 Justin M. Forbes 2024-04-03 16:25:14 UTC

This was fixed for Fedora with the 6.7.5 stable kernel updates.

Comment 4 Alex 2024-06-09 13:02:48 UTC

The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-26682 is: 	SKIP	The Fixes patch not applied yet, so unlikely that actual: c09c4f31998bac6d73508e38812518aceb069b68	YES			NO	YES	unknown (where first YES/NO value means if related sources built).