Cloudanix VulnDB

CVE-2026-68405

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's wireless code could cause the system to mishandle network packets during certain shutdown sequences, risking crashes or lost Wi-Fi connections on affected computers and routers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in mac80211 ieee80211_do_stop() that unlinks AP_VLAN SKBs from ps->bc_buf under IRQ-disabled lock then passes them to ieee80211_free_txskb(), which can invoke cfg80211/nl80211 transmit paths requiring IRQ-enabled context, triggering softirq warnings and potential instability.

Why it matters to the business

Wireless access-point or client systems using AP_VLAN interfaces may experience kernel warnings, softirq state corruption, or crashes during interface teardown, leading to temporary loss of Wi-Fi connectivity and requiring reboots in affected Linux deployments.

How an attack unfolds

An attacker with local or adjacent network access triggers concurrent AP_VLAN management TX (attaching ACK-status state and queuing multicast SKB) and AP_VLAN stop paths; the stop path acquires the lock with IRQs disabled and frees the SKB, violating IRQ-state expectations in the free path and surfacing the softirq warning or crash.

How to fix it

Update to a Linux kernel containing the fix that unlinks matching AP_VLAN SKBs under the existing lock, moves them to a local free queue, drops the lock, restores IRQ state, then calls ieee80211_free_txskb().

How to confirm the fix worked

Confirm the kernel source contains the corrected ieee80211_do_stop() logic that frees SKBs after IRQ state is restored; test by exercising AP_VLAN start/stop sequences while generating multicast management traffic and verify absence of the softirq warning.

Typical attack path

  1. Obtain local or wireless-adjacent access to a system using mac80211 AP_VLAN interfaces
  2. Induce concurrent management frame transmission and interface stop/teardown operations
  3. Trigger the race between bc_buf unlink under IRQ lock and ieee80211_free_txskb() netlink callback
  4. Observe softirq warning or kernel instability

How to detect it

Search kernel logs for the exact warning string from softirq.c related to __local_bh_enable_ip during AP_VLAN interface stop operations; correlate with wireless interface teardown events in dmesg or journalctl.

What your security team should do

  • Prioritize kernel updates on systems exposing Wi-Fi AP or AP_VLAN functionality
  • Monitor for the __local_bh_enable_ip warning in kernel logs on wireless hosts
  • Apply the fix during the next maintenance window for any device using mac80211

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free_txskb() before dropping the lock. ieee80211_free_txskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored. The buggy scenario involves two paths, with each column showing the order within that path: AP_VLAN management TX: AP_VLAN stop: 1. attach ACK-status state 1. clear the running state 2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs parent ps->bc_buf disabled 3. unlink the AP_VLAN SKB 4. call ieee80211_free_txskb() Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211_free_txskb(). WARNING: kernel/softirq.c:430 at __local_bh_enable_ip

Affected packages

Ecosystem Package Introduced Fixed