CVE-2026-68126

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mac802154: hold an interface reference across the scan worker<br /> <br /> mac802154_scan_worker() captures the scanning sub-interface under RCU<br /> and then keeps dereferencing sdata-&gt;dev after rcu_read_unlock() and<br /> outside the rtnl -- in the failure traces, in<br /> mac802154_transmit_beacon_req() (skb-&gt;dev = sdata-&gt;dev), and in the<br /> end_scan cleanup. Nothing keeps that netdev alive across the worker<br /> iteration.<br /> <br /> A concurrent DEL_INTERFACE or PHY removal can unregister the interface<br /> once the worker drops the rtnl between its two drv_set_channel()<br /> sections. unregister_netdevice() frees the netdev asynchronously from<br /> netdev_run_todo() with the rtnl already dropped, so neither holding the<br /> rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker<br /> iteration from dereferencing the freed netdev -- a KASAN<br /> slab-use-after-free, reachable by racing TRIGGER_SCAN against<br /> DEL_INTERFACE (both CAP_NET_ADMIN).<br /> <br /> Pin the netdev with netdev_hold() while the RCU read lock is still held,<br /> and release it at every worker exit.