Cloudanix VulnDB

CVE-2026-68126

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless networking code could let a privileged user cause crashes or worse by removing a network interface at the exact wrong moment during a scan operation.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mac802154_scan_worker() where a netdev pointer is dereferenced after RCU unlock and outside rtnl following concurrent interface deletion, allowing slab-use-after-free on freed netdev.

Why it matters to the business

Kernel instability or potential privilege escalation on systems using IEEE 802.15.4 wireless interfaces, increasing crash risk and operational disruption in affected embedded or IoT deployments; low exploitability reduces immediate urgency.

How an attack unfolds

An attacker with CAP_NET_ADMIN privileges triggers a scan via TRIGGER_SCAN while concurrently deleting the interface with DEL_INTERFACE, causing the worker to dereference a freed netdev in transmit or cleanup paths after the device is unregistered.

How to fix it

Apply the upstream fix that adds netdev_hold() while RCU read lock is held and netdev_put() on worker exit; upgrade to a kernel containing the resolution for mac802154 scan worker reference handling.

How to confirm the fix worked

Confirm presence of the reference-holding change in mac802154_scan_worker(); test by racing scan and interface deletion operations under KASAN to verify no UAF reports; monitor for absence of slab-use-after-free in failure traces.

Typical attack path

  1. Obtain CAP_NET_ADMIN on target system
  2. Race TRIGGER_SCAN ioctl against DEL_INTERFACE operation
  3. Trigger mac802154_scan_worker() iteration after netdev free
  4. Dereference stale sdata->dev pointer leading to UAF

How to detect it

Inspect kernel logs for KASAN use-after-free reports involving mac802154_transmit_beacon_req or end_scan paths; correlate with netdevice unregistration events around scan worker activity.

  • KASAN: slab-use-after-free in mac802154_transmit_beacon_req
  • skb->dev dereference after rcu_read_unlock in scan worker
  • unregister_netdevice race with IEEE802154_IS_SCANNING flag

What your security team should do

  • Prioritize kernel updates on systems exposing mac802154 interfaces
  • Restrict CAP_NET_ADMIN to trusted processes only
  • Enable KASAN or similar debug kernels in test environments to validate fixes
  • Monitor for netdev-related oops in system logs on wireless sensor nodes

The record

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.

Affected packages

Ecosystem Package Introduced Fixed