CVE-2026-68409 (GCVE-0-2026-68409)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-10 12:04
VLAI
Title
wifi: mac80211: defer link RX stats percpu free to RCU
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < 2aa1789880fa5e41049b0f6a74a4fc2fa1997610 (git)
Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < a03fceae0c65b31ce31840dac5e26684ceecb65b (git)
Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < aa2eb62525188269cdd402a583b9a8ed94657ff0 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2aa1789880fa5e41049b0f6a74a4fc2fa1997610",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "a03fceae0c65b31ce31840dac5e26684ceecb65b",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "aa2eb62525188269cdd402a583b9a8ed94657ff0",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T12:04:29.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"
        },
        {
          "url": "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"
        }
      ],
      "title": "wifi: mac80211: defer link RX stats percpu free to RCU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68409",
    "datePublished": "2026-08-10T12:04:29.238Z",
    "dateReserved": "2026-07-30T09:28:09.390Z",
    "dateUpdated": "2026-08-10T12:04:29.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68409",
      "date": "2026-08-12",
      "epss": "0.00166",
      "percentile": "0.06225"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:34.537\",\"lastModified\":\"2026-08-10T13:20:34.537\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: defer link RX stats percpu free to RCU\\n\\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\\naway, but defers only the link container to RCU:\\n\\n\\tsta_info_free_link(\u0026alloc-\u003einfo);\\n\\tkfree_rcu(alloc, rcu_head);\\n\\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\\nstats. A reader that resolved link_sta before the removal keeps the\\npointer. The container stays alive from the kfree_rcu, so the read still\\nworks. But the percpu block it points to is already freed. This needs\\nuses_rss. That is when pcpu_rx_stats exists.\\n\\nThe full STA teardown frees the deflink stats only after\\nsynchronize_net(). The link removal path had no such barrier. The race is\\nhard to win in practice, but the free should still wait for RCU.\\n\\nFree the link together with its data from a single RCU callback, so the\\npercpu block is reclaimed only after readers drain.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/sta_info.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"2aa1789880fa5e41049b0f6a74a4fc2fa1997610\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"a03fceae0c65b31ce31840dac5e26684ceecb65b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"aa2eb62525188269cdd402a583b9a8ed94657ff0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/sta_info.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-11T17:41:22+00:00",
      "cve": "CVE-2026-68409",
      "id": "CVE-2026-68409",
      "initial_release_date": "2026-08-10T12:04:29.238000+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Use-after-free vulnerability in mac80211 Wi-Fi driver",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68409.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:46:20Z",
      "cve": "CVE-2026-68409",
      "id": "CVE-2026-68409",
      "initial_release_date": "2026-08-11T23:46:20Z",
      "product_status:known_affected": "117",
      "product_status:known_not_affected": "179",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68409",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68409.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.