CVE-2026-68126: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68126 Overview

CVE-2026-68126 is a use-after-free vulnerability in the Linux kernel's mac802154 subsystem, which handles IEEE 802.15.4 wireless personal area networking. The flaw resides in mac802154_scan_worker(), which dereferences a scanning sub-interface (sdata->dev) after releasing the RCU read lock and outside the rtnl lock. A concurrent DEL_INTERFACE operation or PHY removal can unregister and free the netdev while the worker still holds a stale pointer. The result is a KASAN-detected slab-use-after-free reachable by racing TRIGGER_SCAN against DEL_INTERFACE, both of which require CAP_NET_ADMIN.

Critical Impact
A local user with CAP_NET_ADMIN can trigger a kernel use-after-free by racing IEEE 802.15.4 scan and interface deletion operations, leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel — mac802154 subsystem
Multiple stable kernel branches referenced by the upstream fix commits
Systems configured with IEEE 802.15.4 (CONFIG_IEEE802154) support

Discovery Timeline

2026-08-10 - CVE-2026-68126 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68126

Vulnerability Analysis

The defect lies in the interaction between the mac802154 scan worker and the netdev lifecycle. mac802154_scan_worker() acquires a reference to the scanning sub-interface inside an RCU read-side critical section, then continues to use sdata->dev after rcu_read_unlock(). The worker also drops the rtnl mutex between its two drv_set_channel() sections. Neither rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents concurrent interface teardown from proceeding during that window.

When unregister_netdevice() is invoked, the netdev is freed asynchronously from netdev_run_todo() after rtnl is released. If teardown races with the scan worker, subsequent accesses in mac802154_transmit_beacon_req() (specifically skb->dev = sdata->dev) and in the end_scan cleanup path operate on freed memory. KASAN reports this as a slab-use-after-free.

Root Cause

The root cause is missing reference counting on the netdev across the scan worker iteration. The code assumed that rtnl plus the scanning flag would keep the interface alive, but asynchronous netdev freeing via netdev_run_todo() breaks that assumption.

Attack Vector

A local attacker with CAP_NET_ADMIN can invoke TRIGGER_SCAN on an IEEE 802.15.4 interface while a second thread issues DEL_INTERFACE for the same sub-interface. Hitting the narrow window between the worker's rcu_read_unlock() and subsequent sdata->dev dereferences yields a use-after-free in kernel context. Exploitability depends on the ability to reclaim the freed slab object with controlled data.

The upstream fix pins the netdev by calling netdev_hold() while the RCU read lock is still held and releases the reference at every worker exit path, ensuring the netdev remains valid for the entire iteration.

Detection Methods for CVE-2026-68126

Indicators of Compromise

KASAN reports referencing slab-use-after-free in mac802154_scan_worker, mac802154_transmit_beacon_req, or the end_scan cleanup path.
Kernel oops or panic traces containing sdata->dev dereferences following a DEL_INTERFACE netlink operation on an IEEE 802.15.4 PHY.
Unexpected RIP values in kernel logs pointing into freed netdev memory during active 802.15.4 scans.

Detection Strategies

Enable KASAN on test kernels running 802.15.4 workloads to surface the use-after-free deterministically during fuzzing.
Audit nl802154 netlink activity for interleaved TRIGGER_SCAN and DEL_INTERFACE operations issued by the same or coordinated processes.
Monitor kernel ring buffer output for general protection fault or BUG: KASAN entries referencing mac802154.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized SIEM and alert on kernel oops or KASAN signatures.
Track processes that hold CAP_NET_ADMIN and perform 802.15.4 operations, particularly in containerized or multi-tenant environments.
Baseline the frequency of nl802154TRIGGER_SCAN and DEL_INTERFACE operations to detect abnormal race attempts.

How to Mitigate CVE-2026-68126

Immediate Actions Required

Apply the upstream stable kernel updates that incorporate the netdev_hold() fix in mac802154_scan_worker().
Where patching is not immediate, restrict CAP_NET_ADMIN to trusted administrators and remove it from unprivileged workloads and containers.
Unload the mac802154 and ieee802154 modules on systems that do not use IEEE 802.15.4 hardware.

Patch Information

The fix is available in the following upstream commits: Kernel Commit 234e5e8, Kernel Commit 59c1d54, Kernel Commit 5f303f6, Kernel Commit bd7110f, and Kernel Commit dd47541. The patch pins the netdev via netdev_hold() while the RCU read lock is held and calls netdev_put() at every worker exit.

Workarounds

Blacklist the mac802154 and ieee802154_socket modules on hosts without 802.15.4 radios: add blacklist mac802154 to /etc/modprobe.d/.
Drop CAP_NET_ADMIN from container profiles and systemd unit files that do not require network configuration privileges.
Constrain nl802154 access with seccomp or Landlock profiles for services that must run with elevated capabilities.

bash

# Prevent loading of the vulnerable module until patched
echo 'blacklist mac802154' | sudo tee /etc/modprobe.d/disable-mac802154.conf
echo 'install mac802154 /bin/true' | sudo tee -a /etc/modprobe.d/disable-mac802154.conf
sudo update-initramfs -u