CVE-2026-74661
Received Received - Intake

Use-After-Free in Linux Kernel mac802154 Beacon Worker

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpan_dev. mac802154_stop_beacons_locked() cancels only pending beacon work, clears local->beacon_req and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area. The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74661
EUVD
EUVD-2026-64348

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's mac802154 subsystem. It occurs when the beacon worker function accesses freed memory due to improper handling of netdev references during interface teardown. The worker reads beacon requests under RCU protection but drops the lock before completing operations, leading to potential crashes or privilege escalation.

Detection Guidance

This vulnerability involves a use-after-free in the mac802154 subsystem of the Linux kernel. Detection requires checking for kernel logs or crashes related to mac802154 or beacon worker processes. Monitor system logs for kernel oops or panics involving netdev or mac802154. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could allow an attacker to cause system crashes, execute arbitrary code, or gain elevated privileges on affected systems. It specifically targets systems using the mac802154 wireless protocol stack, potentially disrupting network operations or enabling further exploits.

Mitigation Strategies

Apply the latest Linux kernel patches to address the use-after-free in mac802154. Update to a kernel version that includes the fix for CVE-2026-74661. If immediate patching is not possible, consider disabling the mac802154 module or restricting its use until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart