CVE-2026-72024 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users who rely on the mac802154 implementation should be aware of this vulnerability and take necessary actions to mitigate it. They should assess potential exposure, apply patches or updates, and monitor for potential exploit attempts or suspicious activity. Security teams and vulnerability management teams should also be aware of this vulnerability and review compensating controls for exposed systems.

Technical summary

The Linux kernel's mac802154 implementation is vulnerable to a use-after-free attack. The bulk hardware teardown path removes entries with list_del(), which can lead to an asynchronous transmit completion following a poisoned list node in ieee802154_wake_queue(). To mitigate this vulnerability, it is recommended to apply patches or updates provided by the Linux kernel maintainers. Affected Linux kernel developers, maintainers, and users should assess potential exposure and take necessary actions.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel versions for potential exposure
• Apply patches or updates provided by the Linux kernel maintainers
• Monitor for potential exploit attempts or suspicious activity
• Consider implementing compensating controls, such as network segmentation or access controls
• Review and verify affected scope and severity with the Linux kernel maintainers
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis is required to fully understand the impact and affected scope. Linux kernel developers and maintainers should verify the vulnerability details and assess potential exposure. The vulnerability is related to the mac802154 implementation in the Linux kernel. Defensive verification tasks are necessary to confirm affected systems and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.