CVE-2026-68126 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
mac802154: hold an interface reference across the scan worker
mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration.
A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN).
Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the linux kernel's mac802154 subsystem where a race condition can lead to use-after-free conditions during wireless network scanning operations. The flaw occurs in the mac802154_scan_worker() function which processes scanning operations for 802.15.4 wireless networks. The vulnerability stems from improper reference counting of network device structures during asynchronous operations, creating a window where interface cleanup can occur while worker threads are still accessing freed memory resources.
The technical implementation issue involves the mac802154_scan_worker() function capturing scanning sub-interface information under RCU (Read-Copy-Update) protection but subsequently dereferencing sdata->dev after rcu_read_unlock() and outside of rtnl (netlink) locking context. This creates a temporal gap where the network device reference becomes invalid while the worker thread continues execution, particularly during failure traces in mac802154_transmit_beacon_req() where skb->dev = sdata->dev is accessed, and during end_scan cleanup operations. The absence of proper reference management allows for concurrent DEL_INTERFACE or PHY removal operations to unregister interfaces between the two drv_set_channel() sections, leading to asynchronous netdev freeing.
The operational impact of this vulnerability reaches a critical severity level as it enables a KASAN (Kernel Address Sanitizer) slab-use-after-free condition. This vulnerability is reachable through racing TRIGGER_SCAN against DEL_INTERFACE operations and requires only CAP_NET_ADMIN capabilities, making it exploitable by users with network administration privileges. The race condition specifically occurs when unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() after the rtnl lock has already been dropped, rendering both rtnl locking and per-PHY IEEE802154_IS_SCANNING flag protections ineffective against stale worker iterations accessing freed memory structures.
The mitigation strategy involves implementing proper reference counting mechanisms by pinning the network device with netdev_hold() while the RCU read lock remains active. This approach ensures that the netdev reference remains valid throughout the worker iteration lifecycle, preventing access to freed memory structures. The solution requires releasing these references at every worker exit point, effectively creating a protective barrier around the scanning operation that maintains object validity across asynchronous cleanup operations. This fix aligns with established security practices for kernel memory management and prevents the temporal inconsistency that leads to use-after-free vulnerabilities.
This vulnerability type maps directly to CWE-416 (Use After Free) and CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), with potential ATT&CK techniques including T1059.001 (Command and Scripting Interpreter: PowerShell) for exploitation scenarios involving privilege escalation through network administration capabilities. The fix demonstrates proper kernel memory management practices that prevent race conditions in concurrent systems, specifically addressing the lack of reference counting across RCU boundaries in wireless networking subsystems.