CVE-2026-23336: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23336 Overview

A use-after-free vulnerability has been identified in the Linux kernel's WiFi cfg80211 subsystem, specifically in the cfg80211_shutdown_all_interfaces function. The vulnerability was discovered through Syzkaller, a kernel fuzzing tool, and occurs when the rfkill_block work is not properly cancelled during wiphy unregistration. This race condition can lead to memory corruption and potential system instability.

Critical Impact

This use-after-free vulnerability in the Linux kernel WiFi subsystem can lead to memory corruption, kernel crashes, and potential privilege escalation on affected systems.

Affected Products

• Linux kernel versions prior to patched releases
• Systems running WiFi configurations with cfg80211 subsystem
• Kernel versions including 6.19.0-rc2 and potentially earlier versions

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23336 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23336

Vulnerability Analysis

This use-after-free vulnerability manifests in the Linux kernel's cfg80211 WiFi configuration subsystem. The issue stems from improper lifecycle management of work queue items during device unregistration. When a wiphy device is being unregistered through wiphy_unregister(), the associated rfkill_block work item may still be pending or executing in the background workqueue. If this work executes after the wiphy structure has been freed, it attempts to access deallocated memory, resulting in a use-after-free condition.

The KASAN (Kernel Address Sanitizer) report indicates a read of 8 bytes from an invalid address (ffff888112a78d98) by the kworker process, confirming the memory has been freed while still being referenced by the workqueue handler.

Root Cause

The root cause lies in the absence of work cancellation during wiphy unregistration. The cfg80211_rfkill_block_work function is scheduled to run asynchronously via the events workqueue. When wiphy_unregister() is called, it frees resources associated with the wiphy structure, but it fails to cancel any pending rfkill_block work items. This creates a race condition where the work function may execute after its associated data structures have been deallocated.

The fix involves adding a call to cancel the rfkill_block work in wiphy_unregister() before proceeding with resource cleanup, ensuring all pending work items complete or are cancelled before memory is freed.

Attack Vector

The attack vector for this vulnerability requires local access to trigger the race condition. An attacker with the ability to manipulate WiFi device registration and unregistration timing could potentially exploit this vulnerability. The exploitation scenario involves:

1. Triggering wiphy device unregistration while rfkill_block work is pending
2. Racing the work completion against memory deallocation
3. Causing the use-after-free to corrupt kernel memory

While the vulnerability was found through automated fuzzing rather than active exploitation, use-after-free conditions in kernel space can potentially be leveraged for privilege escalation or denial of service attacks. The vulnerability requires precise timing to exploit, making it moderately complex to weaponize.

Detection Methods for CVE-2026-23336

Indicators of Compromise

• KASAN reports indicating use-after-free in cfg80211_shutdown_all_interfaces
• Kernel panic or crash dumps referencing cfg80211_rfkill_block_work
• System instability during WiFi device removal or reconfiguration
• Suspicious kworker process crashes in system logs

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in development and testing environments to detect memory safety violations
• Monitor kernel logs for use-after-free warnings or crashes in the cfg80211 subsystem
• Deploy kernel live patching solutions to identify unpatched systems
• Use SentinelOne Singularity platform for real-time kernel-level threat detection

Monitoring Recommendations

• Configure syslog monitoring for kernel oops and panic messages related to cfg80211
• Implement continuous kernel version auditing to identify vulnerable deployments
• Monitor WiFi subsystem events for unusual device registration/unregistration patterns
• Enable kernel tracing for workqueue events in the cfg80211 module during security assessments

How to Mitigate CVE-2026-23336

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix
• Review systems running WiFi configurations for kernel version compliance
• Apply vendor-specific kernel updates from your Linux distribution
• Consider disabling WiFi functionality on critical systems until patched

Patch Information

Multiple patches have been committed to the Linux kernel stable branches to address this vulnerability. The fix involves cancelling the rfkill_block work in wiphy_unregister() to prevent the race condition. Relevant kernel commits include:

• Kernel Commit 57e39fe8
• Kernel Commit 584279ad
• Kernel Commit 767d23ad
• Kernel Commit cd2f5294
• Kernel Commit eeea8da4
• Kernel Commit fa18639d

Workarounds

• If patching is not immediately possible, consider disabling WiFi functionality on affected systems
• Restrict local access to systems to reduce exposure to exploitation attempts
• Monitor kernel logs actively for signs of exploitation attempts
• Deploy kernel live patching solutions for interim protection where available

# Check current kernel version for vulnerability assessment
uname -r

# Monitor for cfg80211 related kernel messages
dmesg | grep -i cfg80211

# Check if WiFi module is loaded
lsmod | grep cfg80211