CVE-2026-68409

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how Linux handles certain WiFi connections can let someone nearby crash devices or potentially take them over if memory cleanup is not properly synchronized.

Exploitation: Adjacent Network
Attacker needs: None
Complexity: Moderate
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Use-after-free in mac80211 link RX stats percpu buffer: sta_remove_link frees the percpu allocation immediately while only the containing structure is RCU-deferred; concurrent RCU readers in the RX fast path that hold a resolved link_sta pointer dereference the already-freed percpu block when uses_rss is set.

Why it matters to the business

Linux WiFi devices supporting MLO can experience kernel memory corruption leading to crashes, denial of service, or potential remote code execution from adjacent network attackers, disrupting wireless connectivity and requiring urgent patching across fleets.

How an attack unfolds

An attacker on the same wireless network triggers repeated MLO link addition and removal operations while sending crafted frames that cause the RX fast path to resolve and write to the link's percpu stats under rcu_read_lock; the window between immediate percpu free and RCU grace period allows the freed memory to be dereferenced or reused.

How to fix it

Apply the upstream fix that moves percpu buffer reclamation into the same RCU callback as the container (single kfree_rcu path) or upgrade to a kernel containing the corrected mac80211 link teardown logic; rebuild and reboot affected systems after patching.

How to confirm the fix worked

Confirm the patch is present by inspecting sta_remove_link and sta_info_free_link for a unified RCU callback that frees both container and percpu stats; recompile with CONFIG_RCU_STRICT_GRACE_PERIOD and run stress tests exercising link add/remove under concurrent RX load to verify absence of the race.

Typical attack path

Establish or manipulate MLO links on a target STA
Induce sta_remove_link on the victim link
Simultaneously drive RX traffic that resolves link_sta under RCU
Write to the now-freed percpu_rx_stats block
Trigger memory corruption or crash

How to detect it

Review kernel logs for use-after-free warnings, KASAN reports, or RCU-related splats mentioning mac80211, link_sta, or percpu_rx_stats during periods of MLO link churn; correlate with wireless interface state changes and high RX traffic.

What your security team should do

Prioritize patching wireless-enabled Linux kernels within normal change windows given the high CVSS and network-adjacent attack vector
Monitor upstream wireless and stable kernel trees for the merged commit
Temporarily disable MLO/802.11be features if the workload permits until patches are deployed
Include kernel oops and RCU usage warnings in existing crash-dump review processes

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.

Affected packages

Ecosystem	Package	Introduced	Fixed