CVE-2026-68126
Received Received - Intake

Use-After-Free in Linux Kernel mac802154 Scan Worker

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68126
EUVD
EUVD-2026-55507

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the mac802154 subsystem. The mac802154_scan_worker() function captures a scanning sub-interface under RCU protection but dereferences the netdev after releasing the RCU lock and outside the rtnl lock. A concurrent DEL_INTERFACE or PHY removal can unregister the interface, leading to a slab-use-after-free when the worker tries to access the freed netdev. This is triggered by racing TRIGGER_SCAN against DEL_INTERFACE with CAP_NET_ADMIN privileges.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac802154 subsystem and involves a use-after-free condition during scanning operations. Detection requires kernel-level monitoring for slab-use-after-free errors, particularly when TRIGGER_SCAN and DEL_INTERFACE operations race. Check kernel logs for KASAN reports or slab corruption messages after triggering scan operations on 802.15.4 interfaces.

Impact Analysis

This vulnerability could allow an attacker with CAP_NET_ADMIN privileges to trigger a kernel crash or execute arbitrary code by exploiting a race condition between interface deletion and scanning operations. This may lead to denial-of-service conditions or potential privilege escalation on affected systems.

Mitigation Strategies

Apply the latest kernel security patches that address this issue. Avoid concurrent TRIGGER_SCAN and DEL_INTERFACE operations on 802.15.4 interfaces. Monitor kernel logs for slab-use-after-free errors. If affected, consider disabling the mac802154 module until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart