CVE-2026-68404 Overview
CVE-2026-68404 affects the Linux kernel's cfg80211 wireless configuration subsystem. The flaw exists in the socket owner autodisconnect path handled by nl80211_netlink_notify(). A race between the NETLINK_URELEASE notifier and wireless device teardown can queue work against a wdev after it has been removed from the wireless device list. The result is a local, low-privilege condition that can corrupt kernel state on affected systems running the vulnerable Netlink code path.
Critical Impact
A local user with the ability to open NETLINK_GENERIC sockets can trigger a race in cfg80211 teardown that risks kernel memory corruption, potentially leading to privilege escalation or denial of service.
Affected Products
- Linux kernel builds containing the cfg80211 socket owner autodisconnect code path prior to the fix
- Distributions shipping the affected mainline wifi: cfg80211 subsystem
- Systems where NETLINK_GENERIC sockets are available to unprivileged or low-privileged users
Discovery Timeline
- 2026-08-10 - CVE-2026-68404 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68404
Vulnerability Analysis
The nl80211_netlink_notify() function walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the released socket owns an active wireless connection, the notifier queues the embedded wdev->disconnect_wk work item to trigger an autodisconnect. This work item is implemented as a plain work_struct.
The teardown path in _cfg80211_unregister_wdev() uses NETDEV_GOING_DOWN to cancel the pending work, then calls list_del_rcu() followed by synchronize_net(). However, a concurrent NETLINK_URELEASE notifier that has already observed conn_owner_nlportid can queue the work item after the cancel has returned. synchronize_net() only drains RCU readers and does not wait for work queued by such a reader to complete.
Root Cause
The root cause is a race condition [CWE-362] between the Netlink release notifier and wireless device unregistration. The disconnect work is a generic work_struct rather than a wiphy_work, so it cannot be safely canceled under the wiphy mutex during teardown. Work queued after list_del_rcu() can operate on a wdev that is being freed, resulting in a use-after-free on kernel-managed structures.
Attack Vector
An attacker requires local access and the ability to create NETLINK_GENERIC sockets that own a cfg80211 connection. By racing socket release against wireless device teardown, the attacker triggers the work queue path after the wdev has been removed. Exploitation depends on precise timing between the NETLINK_URELEASE notifier and the unregistration path. The fix converts the autodisconnect work into a wiphy_work that runs under the wiphy mutex, and cancels the work after list_del_rcu() and synchronize_net(), closing the race window.
See the upstream commit 6d6123fe and commit 0c2ed186 for the patch details.
Detection Methods for CVE-2026-68404
Indicators of Compromise
- Unexpected kernel oops or panic entries referencing cfg80211, nl80211_netlink_notify, or disconnect_wk in dmesg or /var/log/kern.log
- KASAN or slab-corruption reports naming wireless_dev or cfg80211 allocations
- Processes repeatedly opening and closing NETLINK_GENERIC sockets while managing wireless connections
Detection Strategies
- Monitor kernel logs for use-after-free and workqueue-related warnings tied to the cfg80211 subsystem
- Audit installed kernel versions against distribution advisories referencing the wifi: cfg80211 autodisconnect fix
- Correlate wireless disconnect events with abnormal process termination and Netlink socket churn
Monitoring Recommendations
- Enable and review KASAN or CONFIG_DEBUG_KMEMLEAK output on test builds to catch race-driven corruption
- Alert on kernel crashes referencing nl80211 or cfg80211 symbols in production telemetry
- Track userspace processes with elevated Netlink socket activity for triage
How to Mitigate CVE-2026-68404
Immediate Actions Required
- Identify all Linux systems running kernels that include the vulnerable cfg80211 socket owner autodisconnect logic
- Apply the vendor-supplied kernel update that converts disconnect_wk to a wiphy_work and repositions the cancel after synchronize_net()
- Reboot affected hosts after patching so the fixed kernel is active
Patch Information
The upstream fix is available in the mainline stable tree via commit 6d6123fe and commit 0c2ed186. Consume the fix through your distribution's kernel package or by rebuilding a kernel that includes these commits.
Workarounds
- Restrict local access on systems where kernel updates cannot be applied immediately
- Limit which users and services can open NETLINK_GENERIC sockets and manage wireless connections through standard Linux capability controls
- Disable or unload the cfg80211 module on hosts that do not require wireless functionality until the patched kernel is deployed
# Verify running kernel version and confirm the patched build is in place
uname -r
# Example: check whether the loaded cfg80211 module is present
lsmod | grep cfg80211
# On hosts without wireless requirements, prevent the module from loading
echo 'blacklist cfg80211' | sudo tee /etc/modprobe.d/disable-cfg80211.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
