CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix data race and NULL deref on local->assoc dev

local->assoc dev is shared between the association path and the association-response worker without common synchronization.

mac802154 perform association() stores the coordinator pointer and waits for a response. Its timeout and error paths clear the pointer and return to mac802154 associate(), which may then free the coordinator object. Meanwhile, mac802154 rx mac cmd worker() may observe the associating bit and enter mac802154 process association resp(), which dereferences assoc dev.

The worker's bit test and the handler's pointer dereference are not atomic with respect to cleanup. Cleanup can clear assoc dev between them, causing a NULL dereference, or free the coordinator while the response handler still uses the pointer.

The recorded result is exposed to the same window. assoc status and assoc addr are written by the handler but read by the association path while the associating bit is still set, so a second response for the same request - a malicious one, for instance - can replace them between those reads and leave the caller with an incoherent status and address pair.

The response handler only needs the coordinator extended address. Replace assoc dev with a cached address, removing the pointer lifetime dependency. Protect the cached address and the associating bit with a dedicated spinlock. A READ ONCE()/WRITE ONCE() pair would not guarantee an atomic le64 access on all 32-bit architectures.

wpan dev->association lock cannot be reused here: nl802154 associate() holds it across rdev associate(), hence for the whole of mac802154 perform association() including the wait for the response. A response handler taking that lock would only get it once the association has already given up.

Reset the completion, publish the cached address, and set the associating bit while holding the lock. The response handler takes the lock, rechecks the bit and the cached address, records the response, clears the bit, and only then completes the waiter. Thus cleanup cannot pass the handler between its state check and completion, and the cached 64-bit value cannot tear.

The handler clears the bit before completing, not the woken waiter: otherwise complete() is issued under the lock and a second (e.g. malicious) response can reacquire it before the waiter and replace the result. So a wait that returns success implies the bit is already clear, and the success and negative-response paths return directly. The transmit-error and timeout paths still clear it under assoc lock, which serializes any racing response against the cleanup while the call returns the error it already selected. Both paths snapshot assoc status and assoc addr under the same lock.

Both users run in process context, so a plain spinlock is sufficient. The lock is not held while waiting for the completion.