CVE-2026-68409

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mac80211 wifi module where the sta remove link() function frees a removed MLO link's RX stats percpu buffer immediately, while only deferring the link container to RCU (Read-Copy-Update, a synchronization mechanism). Because the RX fast path reads link sta under rcu read lock and writes to the percpu stats, a reader that resolved link sta before removal may still hold a pointer to a percpu block that has already been freed. This occurs when uses rss is active and pcpu rx stats exists. While the full STA teardown uses synchronize net() as a barrier, the link removal path lacks this, creating a race condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.