CVE-2026-68126

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the mac802154 scan worker() function. The function captures the scanning sub-interface under RCU but continues to dereference sdata->dev after rcu read unlock() and outside the rtnl. This occurs specifically within mac802154 transmit beacon req() and during end scan cleanup. Because nothing maintains the netdev reference across the worker iteration, a concurrent DEL INTERFACE or PHY removal can unregister the interface. Since unregister netdevice() frees the netdev asynchronously via netdev run todo(), a stale worker iteration may dereference the freed netdev. This condition is reachable by racing TRIGGER SCAN against DEL INTERFACE, both requiring CAP NET ADMIN privileges.

Recommendations Pin the netdev using netdev hold() while the RCU read lock is held and release it at every worker exit.