Cloudanix VulnDB

CVE-2026-23336

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's wireless code can let someone already on the computer crash the system or potentially take it over.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in cfg80211_shutdown_all_interfaces caused by rfkill_block workqueue item executing after wiphy_unregister has freed associated structures.

Why it matters to the business

Local attackers or compromised processes can trigger kernel crashes, memory corruption, or potential privilege escalation on Linux systems with Wi-Fi drivers; high prevalence of the kernel in servers, cloud instances, and endpoints increases exposure.

How an attack unfolds

An attacker with local access triggers interface shutdown or rfkill events that queue cfg80211_rfkill_block_work; concurrent wiphy unregistration frees the wiphy while the work item remains scheduled, leading to a use-after-free when the work executes.

How to fix it

Apply the upstream fix that cancels the rfkill_block work inside wiphy_unregister(); monitor for and install the patched Linux kernel version once released by distributions.

How to confirm the fix worked

Verify the presence of the cancel work call in wiphy_unregister() in the running kernel source; confirm absence of the KASAN use-after-free report during interface shutdown tests.

Typical attack path

  1. Obtain local code execution or access on a Linux system
  2. Trigger Wi-Fi interface registration and subsequent unregistration (e.g., via rfkill or driver unload)
  3. Race the shutdown path with the pending rfkill work item
  4. Trigger the use-after-free during workqueue execution to corrupt kernel memory or crash the system

How to detect it

Search kernel logs and crash reports for KASAN use-after-free messages referencing cfg80211_shutdown_all_interfaces and cfg80211_rfkill_block_work; examine workqueue activity around wiphy unregistration events.

  • BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces
  • cfg80211_rfkill_block_work
  • Workqueue: events cfg80211_rfkill_block_work
  • Read of size 8 at addr .* by task kworker

What your security team should do

  • Prioritize kernel updates on all Wi-Fi-enabled Linux hosts once fixed packages are available
  • Restrict local user access on multi-tenant systems until patched
  • Enable kernel hardening features such as KASAN in test environments to detect similar issues
  • Monitor EPSS trend and any future exploit maturity reports for increased urgency

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK> The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities