CVE-2026-68409
Received Received - Intake

Memory Leak in Linux Kernel WiFi Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68409
EUVD
EUVD-2026-55595

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's WiFi subsystem (mac80211). It occurs when a wireless link's RX statistics memory is freed prematurely while another process might still be accessing it. The issue arises because the link container is freed via RCU (Read-Copy-Update) but its associated percpu RX stats buffer is freed immediately, leading to a use-after-free scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct detection commands. Monitor kernel logs for sta_remove_link() errors or RCU warnings. Check for crashes in wireless drivers using dmesg or journalctl. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could cause kernel crashes or memory corruption if exploited. It may lead to system instability, denial-of-service conditions, or potential privilege escalation. However, the race condition is difficult to trigger in practice due to timing requirements.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-68409. Reboot the system to apply the update. Monitor wireless network stability and kernel logs for any anomalies after the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart