mac802154: hold an interface reference across the scan worker

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-68126
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-10 13:19:57 UTC
Updated2026-08-10 13:19:57 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 57588c71177f0bfc08509c2c3a9bfe32850c0786 bd7110f0caa32426140ff302a209c53294ef2cfd git Not specified
CNA Linux Linux affected 57588c71177f0bfc08509c2c3a9bfe32850c0786 dd4754194a706163294b6141460101b99082c8c7 git Not specified
CNA Linux Linux affected 57588c71177f0bfc08509c2c3a9bfe32850c0786 59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b git Not specified
CNA Linux Linux affected 57588c71177f0bfc08509c2c3a9bfe32850c0786 5f303f622f6bb8907c405e5123a0ab0f70fb0065 git Not specified
CNA Linux Linux affected 57588c71177f0bfc08509c2c3a9bfe32850c0786 234e5e898b713bc0b3a631b6f002897f43d046c8 git Not specified
CNA Linux Linux affected 6.3 Not specified
CNA Linux Linux unaffected 6.3 semver Not specified
CNA Linux Linux unaffected 6.6.148 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.101 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.42 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.6 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc5 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report