Cloudanix VulnDB

CVE-2026-68414

High · 7.5

CVSS

7.5

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel's wireless handling can let a running background task touch memory that has already been freed, which may crash the system or allow an attacker with local access to gain higher privileges.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in cfg80211_sched_scan_results_wk when a scheduled scan result work item executes after wiphy_unregister and cfg80211_dev_free have released the containing rdev, allowing the worker to lock and walk already-freed wiphy and scheduled-scan state.

Why it matters to the business

Wireless-enabled Linux systems can experience kernel crashes or memory corruption during interface teardown or driver unload, leading to denial of service, loss of wireless connectivity, and potential local privilege escalation on affected kernels.

How an attack unfolds

An attacker with the ability to trigger or observe scheduled scan result notifications (via local wireless activity or crafted driver callbacks) races the result work item against interface unregister and free paths; the queued worker then dereferences freed rdev structures after the unregister path has already drained other work and released the object.

How to fix it

Apply the upstream fix that adds cancel_work_sync for sched_scan_res_wk inside wiphy_unregister before any other rdev work items are drained; rebuild and deploy the patched kernel to all affected wireless-enabled systems.

How to confirm the fix worked

Confirm the cancel_work_sync call for sched_scan_res_wk exists in wiphy_unregister in the running kernel source; reproduce the original KASAN report path under interface unregister while scheduled scans are active and verify the report no longer occurs.

Typical attack path

  1. Trigger or allow a scheduled scan result notification that queues rdev->sched_scan_res_wk
  2. Initiate or force interface teardown that removes the scan request and calls wiphy_unregister
  3. wiphy_unregister drains other rdev work items but leaves sched_scan_res_wk pending
  4. cfg80211_dev_free releases the rdev while the result worker is still runnable or executing
  5. The worker callback dereferences freed rdev state, triggering the use-after-free

How to detect it

Search kernel logs and crash dumps for the exact strings from the reported KASAN use-after-free in cfg80211_sched_scan_results_wk, including the workqueue name cfg80211 and the function name cfg80211_sched_scan_results_wk; correlate with wireless interface unregister or driver unload events.

  • cfg80211_sched_scan_results_wk
  • BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk
  • Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]

What your security team should do

  • Prioritize patching wireless-enabled Linux kernels within normal change windows given the local-only nature and low EPSS
  • Monitor kernel logs for KASAN or BUG reports referencing cfg80211_sched_scan_results_wk during driver or interface events
  • Test the patched kernel in wireless lab environments that exercise scheduled scans and repeated interface register/unregister cycles

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list. wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unregister/free boundary and access freed rdev state. The buggy scenario involves two paths, with each column showing the order within that path: scheduled-scan result path: unregister/free path: 1. cfg80211_sched_scan_results() 1. interface teardown stops and queues rdev->sched_scan_res_wk. removes the scheduled scan request. 2. cfg80211_wq starts the work 2. wiphy_unregister() drains other item and recovers rdev. rdev work items. 3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and and walks rdev state. frees rdev. Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev work items. cancel_work_sync() removes a pending result notification and waits for an already running callback, so cfg80211_dev_free() cannot free rdev while this work item is still active. Validation reproduced this kernel report: BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530 Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211] Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 cfg80211_sched_scan_results_wk+0x4a6/0x530 srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x224/0x430 kasan_report+0xac/0xe0 lockdep_hardirqs_on_prepare+0xea/0x1a0 process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212) lock_is_held_type+0x8f/0x100 worker_thread+0x5ad/0xfd0 __kthread_parkme+0xc6/0x200 kthread+0x31e/0x410 trace_hardirqs_on+0x1a/0x170 ret_from_fork+0x576/0x810 __switch_to+0x57e/0xe20 __switch_to_asm+0x33/0x70 ret_from_fork_asm+0x1a/0x30

Affected packages

Ecosystem Package Introduced Fixed