CVE-2026-68126

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8
https://git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b
https://git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065
https://git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd
https://git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:19

Updated : 2026-08-17 05:18

NVD link : CVE-2026-68126

Mitre link : CVE-2026-68126

CVE.ORG link : CVE-2026-68126

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68126", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786", "lessThan": "bd7110f0caa32426140ff302a209c53294ef2cfd", "versionType": "git"}, {"status": "affected", "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786", "lessThan": "dd4754194a706163294b6141460101b99082c8c7", "versionType": "git"}, {"status": "affected", "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786", "lessThan": "59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b", "versionType": "git"}, {"status": "affected", "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786", "lessThan": "5f303f622f6bb8907c405e5123a0ab0f70fb0065", "versionType": "git"}, {"status": "affected", "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786", "lessThan": "234e5e898b713bc0b3a631b6f002897f43d046c8", "versionType": "git"}], "programFiles": ["net/mac802154/scan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac802154/scan.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:19:57.813", "references": [{"url": "https://git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: hold an interface reference across the scan worker\n\nmac802154_scan_worker() captures the scanning sub-interface under RCU\nand then keeps dereferencing sdata->dev after rcu_read_unlock() and\noutside the rtnl -- in the failure traces, in\nmac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the\nend_scan cleanup. Nothing keeps that netdev alive across the worker\niteration.\n\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\nonce the worker drops the rtnl between its two drv_set_channel()\nsections. unregister_netdevice() frees the netdev asynchronously from\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\niteration from dereferencing the freed netdev -- a KASAN\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\nDEL_INTERFACE (both CAP_NET_ADMIN).\n\nPin the netdev with netdev_hold() while the RCU read lock is still held,\nand release it at every worker exit."}], "lastModified": "2026-08-17T05:18:12.293", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}