CVE-2026-68409 (GCVE-0-2026-68409)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
wifi: mac80211: defer link RX stats percpu free to RCU
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < 2aa1789880fa5e41049b0f6a74a4fc2fa1997610 (git)
Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < a03fceae0c65b31ce31840dac5e26684ceecb65b (git)
Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < aa2eb62525188269cdd402a583b9a8ed94657ff0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2aa1789880fa5e41049b0f6a74a4fc2fa1997610",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "a03fceae0c65b31ce31840dac5e26684ceecb65b",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "aa2eb62525188269cdd402a583b9a8ed94657ff0",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.\nAC:L - The attacker controls both sides of the race \u2014 it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block \u2014 and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker\u0027s influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).\nPR:N - No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.\nUI:N - Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device\u0027s user.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.\nI:H - The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there \u2014 an attacker-timed write primitive into arbitrary recycled kernel state.\nA:H - Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:59.807Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"
        },
        {
          "url": "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"
        }
      ],
      "title": "wifi: mac80211: defer link RX stats percpu free to RCU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68409",
    "datePublished": "2026-08-10T12:04:29.238Z",
    "dateReserved": "2026-07-30T09:28:09.390Z",
    "dateUpdated": "2026-08-17T05:04:59.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68409",
      "date": "2026-08-22",
      "epss": "0.00242",
      "percentile": "0.1565"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:34.537\",\"lastModified\":\"2026-08-17T06:17:49.857\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: defer link RX stats percpu free to RCU\\n\\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\\naway, but defers only the link container to RCU:\\n\\n\\tsta_info_free_link(\u0026alloc-\u003einfo);\\n\\tkfree_rcu(alloc, rcu_head);\\n\\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\\nstats. A reader that resolved link_sta before the removal keeps the\\npointer. The container stays alive from the kfree_rcu, so the read still\\nworks. But the percpu block it points to is already freed. This needs\\nuses_rss. That is when pcpu_rx_stats exists.\\n\\nThe full STA teardown frees the deflink stats only after\\nsynchronize_net(). The link removal path had no such barrier. The race is\\nhard to win in practice, but the free should still wait for RCU.\\n\\nFree the link together with its data from a single RCU callback, so the\\npercpu block is reclaimed only after readers drain.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/sta_info.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"2aa1789880fa5e41049b0f6a74a4fc2fa1997610\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"a03fceae0c65b31ce31840dac5e26684ceecb65b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71420db653aba30a234d1e4cf86dde376e604fa\",\"lessThan\":\"aa2eb62525188269cdd402a583b9a8ed94657ff0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/sta_info.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T21:31:09+00:00",
      "cve": "CVE-2026-68409",
      "id": "CVE-2026-68409",
      "initial_release_date": "2026-08-10T12:04:29.238000+00:00",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: defer link RX stats percpu free to RCU",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68409.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:46:20Z",
      "cve": "CVE-2026-68409",
      "id": "CVE-2026-68409",
      "initial_release_date": "2026-08-11T23:46:20Z",
      "product_status:known_affected": "117",
      "product_status:known_not_affected": "179",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68409",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68409.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.