Linux Kernel nl80211 wireless Vulnerability Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-68404

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: use wiphy work for socket owner autodisconnect

nl80211_netlink_notify() walks the cfg80211 wireless device list when a

NETLINK_GENERIC socket is released. If the socket owns a connection, the

notifier queues the embedded wdev->disconnect_wk work item.

That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a

NETLINK_URELEASE notifier that already observed conn_owner_nlportid can

queue it after that cancel returns. _cfg80211_unregister_wdev() then

removes the wdev from the list and waits for RCU readers, but

synchronize_net() does not drain work queued by such a reader.

Make the autodisconnect work a wiphy_work instead. The callback already

needs the wiphy mutex, and wiphy_work runs under that mutex. This lets

teardown cancel pending autodisconnect work while holding the mutex,

without a cancel_work_sync() vs. worker locking concern.

Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any

NETLINK_URELEASE notifier that had already reached the wdev list has then

either queued the work and it is removed, or can no longer find the wdev. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References