CVE-2026-68126 Linux CVE debrief

Who should care

Linux kernel developers and users, network administrators, and security teams responsible for Linux kernel-based systems should be aware of this vulnerability and take necessary actions to mitigate it. They should review the Linux kernel version and patches applied, assess the network configuration and mac802154 subsystem usage, and monitor for suspicious TRIGGER_SCAN and DEL_INTERFACE operations.

Technical summary

The mac802154_scan_worker() function in the Linux kernel captures a scanning sub-interface under RCU and then keeps dereferencing the netdev after rcu_read_unlock() and outside the rtnl. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections, leading to a KASAN slab-use-after-free bug. This issue can be mitigated by applying the patch to pin the netdev with netdev_hold() while the RCU read lock is still held.

Defensive priority

High

Recommended defensive actions

• Apply the patch to pin the netdev with netdev_hold() while the RCU read lock is still held
• Verify and apply any available vendor patches or updates
• Monitor for and restrict TRIGGER_SCAN and DEL_INTERFACE operations
• Implement compensating controls to detect and prevent exploitation
• Review the Linux kernel version and patches applied
• Assess the network configuration and mac802154 subsystem usage
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was resolved by pinning the netdev with netdev_hold() while the RCU read lock is still held, and releasing it at every worker exit. The issue is reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). To verify and mitigate this vulnerability, defenders should review the Linux kernel version and patches applied, assess the network configuration and mac802154 subsystem usage, and monitor for suspicious TRIGGER_SCAN and DEL_INTERFACE operations.

Official resources