CVE-2026-68405 Overview
CVE-2026-68405 is a Linux kernel vulnerability in the mac80211 wireless subsystem. The flaw exists in ieee80211_do_stop() when handling AP_VLAN broadcast buffer socket buffers (SKBs). The function calls ieee80211_free_txskb() while holding ps->bc_buf.lock with interrupts disabled. Because ieee80211_free_txskb() can report dropped frames through cfg80211/nl80211 and reach the netlink tap transmit path, this triggers a softirq safety violation. The kernel emits WARNING: kernel/softirq.c:430 at __local_bh_enable_ip, indicating incorrect locking context during teardown of AP_VLAN interfaces.
Critical Impact
Improper lock handling during AP_VLAN stop can trigger kernel warnings and destabilize wireless interfaces on affected Linux systems.
Affected Products
- Linux kernel mac80211 subsystem
- Systems configured with AP_VLAN wireless interfaces
- Distributions shipping affected upstream kernel revisions
Discovery Timeline
- 2026-08-10 - CVE-2026-68405 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68405
Vulnerability Analysis
The vulnerability resides in the mac80211 AP_VLAN teardown path. ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then invokes ieee80211_free_txskb() before dropping the lock. ieee80211_free_txskb() is not a passive release. For SKBs carrying TX status state, it reports dropped frames through cfg80211/nl80211, and that path can reach netlink tap transmit. Executing this path with local interrupts disabled violates softirq invariants and triggers a kernel warning at __local_bh_enable_ip.
Root Cause
The root cause is an incorrect locking discipline during interface stop. The AP_VLAN management TX path attaches ACK-status state and queues multicast SKBs on the parent ps->bc_buf. The AP_VLAN stop path clears the running state, acquires ps->bc_buf.lock with IRQs disabled, unlinks the AP_VLAN SKB, and then calls ieee80211_free_txskb() while still in atomic context. The free routine cannot safely execute with IRQs disabled because it may traverse into netlink transmit code that expects softirqs to be enabled.
Attack Vector
Exploitation requires local activity that toggles AP_VLAN interfaces while multicast broadcast buffers are queued. The bug manifests during normal interface teardown when wireless AP_VLAN configurations are active. Successful triggering produces kernel warnings and can lead to instability in the wireless data path. No remote network attack vector is documented, and no public proof-of-concept has been published. The fix unlinks matching AP_VLAN SKBs from ps->bc_buf under the existing lock, moves them to a local free queue, and drops the lock and restores IRQ state before calling ieee80211_free_txskb().
Detection Methods for CVE-2026-68405
Indicators of Compromise
- Kernel log entries containing WARNING: kernel/softirq.c:430 at __local_bh_enable_ip
- Stack traces referencing ieee80211_do_stop, ieee80211_free_txskb, or ps->bc_buf during AP_VLAN interface teardown
- Unexpected wireless interface resets on hosts running AP_VLAN configurations
Detection Strategies
- Monitor dmesg and journalctl -k output for __local_bh_enable_ip warnings tied to mac80211
- Correlate kernel warnings with wireless subsystem activity, particularly AP_VLAN start/stop events
- Compare running kernel version and commit history against the fix commits 4b8abf4, 962f755, a424985, be9dfcb, and f3858d5
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on softirq-related warnings
- Track wireless interface lifecycle events on access points and gateways using AP_VLAN
- Include kernel version inventory in configuration management to identify unpatched hosts
How to Mitigate CVE-2026-68405
Immediate Actions Required
- Identify Linux hosts running mac80211 with AP_VLAN configured
- Apply the upstream kernel patches referenced in the stable tree commits
- Restart affected wireless services after patching to clear residual state
Patch Information
The fix is available in the upstream Linux stable tree. Relevant commits include Linux Kernel Commit 4b8abf4, Linux Kernel Commit 962f755, Linux Kernel Commit a424985, Linux Kernel Commit be9dfcb, and Linux Kernel Commit f3858d5. The patch moves affected AP_VLAN SKBs to a local free queue, releases the lock, restores IRQ state, and only then calls ieee80211_free_txskb().
Workarounds
- Avoid AP_VLAN configurations on affected kernels where feasible
- Track distribution vendor advisories for backported fixes and apply as soon as available
- Limit local privileges required to reconfigure wireless interfaces on production systems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
