CVE-2026-68126 (GCVE-0-2026-68126)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:59
VLAI
Title
mac802154: hold an interface reference across the scan worker
Summary
In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < bd7110f0caa32426140ff302a209c53294ef2cfd (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < dd4754194a706163294b6141460101b99082c8c7 (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 5f303f622f6bb8907c405e5123a0ab0f70fb0065 (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 234e5e898b713bc0b3a631b6f002897f43d046c8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac802154/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd7110f0caa32426140ff302a209c53294ef2cfd",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "dd4754194a706163294b6141460101b99082c8c7",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "5f303f622f6bb8907c405e5123a0ab0f70fb0065",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "234e5e898b713bc0b3a631b6f002897f43d046c8",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac802154/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: hold an interface reference across the scan worker\n\nmac802154_scan_worker() captures the scanning sub-interface under RCU\nand then keeps dereferencing sdata-\u003edev after rcu_read_unlock() and\noutside the rtnl -- in the failure traces, in\nmac802154_transmit_beacon_req() (skb-\u003edev = sdata-\u003edev), and in the\nend_scan cleanup. Nothing keeps that netdev alive across the worker\niteration.\n\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\nonce the worker drops the rtnl between its two drv_set_channel()\nsections. unregister_netdevice() frees the netdev asynchronously from\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\niteration from dereferencing the freed netdev -- a KASAN\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\nDEL_INTERFACE (both CAP_NET_ADMIN).\n\nPin the netdev with netdev_hold() while the RCU read lock is still held,\nand release it at every worker exit."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:59:17.559Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065"
        },
        {
          "url": "https://git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8"
        }
      ],
      "title": "mac802154: hold an interface reference across the scan worker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68126",
    "datePublished": "2026-08-10T11:58:47.478Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-17T04:59:17.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68126",
      "date": "2026-08-20",
      "epss": "0.00175",
      "percentile": "0.07333"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68126\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:57.813\",\"lastModified\":\"2026-08-17T05:18:12.293\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmac802154: hold an interface reference across the scan worker\\n\\nmac802154_scan_worker() captures the scanning sub-interface under RCU\\nand then keeps dereferencing sdata-\u003edev after rcu_read_unlock() and\\noutside the rtnl -- in the failure traces, in\\nmac802154_transmit_beacon_req() (skb-\u003edev = sdata-\u003edev), and in the\\nend_scan cleanup. Nothing keeps that netdev alive across the worker\\niteration.\\n\\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\\nonce the worker drops the rtnl between its two drv_set_channel()\\nsections. unregister_netdevice() frees the netdev asynchronously from\\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\\niteration from dereferencing the freed netdev -- a KASAN\\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\\nDEL_INTERFACE (both CAP_NET_ADMIN).\\n\\nPin the netdev with netdev_hold() while the RCU read lock is still held,\\nand release it at every worker exit.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac802154/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"57588c71177f0bfc08509c2c3a9bfe32850c0786\",\"lessThan\":\"bd7110f0caa32426140ff302a209c53294ef2cfd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57588c71177f0bfc08509c2c3a9bfe32850c0786\",\"lessThan\":\"dd4754194a706163294b6141460101b99082c8c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57588c71177f0bfc08509c2c3a9bfe32850c0786\",\"lessThan\":\"59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57588c71177f0bfc08509c2c3a9bfe32850c0786\",\"lessThan\":\"5f303f622f6bb8907c405e5123a0ab0f70fb0065\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"57588c71177f0bfc08509c2c3a9bfe32850c0786\",\"lessThan\":\"234e5e898b713bc0b3a631b6f002897f43d046c8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac802154/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T11:58:15+00:00",
      "cve": "CVE-2026-68126",
      "id": "CVE-2026-68126",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mac802154: hold an interface reference across the scan worker",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68126.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-17T16:29:56Z",
      "cve": "CVE-2026-68126",
      "id": "CVE-2026-68126",
      "initial_release_date": "2026-08-17T16:29:56Z",
      "product_status:known_affected": "32",
      "product_status:known_not_affected": "264",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68126",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68126.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.