CVE-2026-68408: Linux Kernel Race Condition Vulnerability

CVE-2026-68408 Overview

CVE-2026-68408 is a deadlock vulnerability in the Linux kernel cfg80211 wireless configuration subsystem. The flaw resides in the Peer Measurement (PMSR) session teardown path, where pmsr_free_wk work item interacts unsafely with wiphy_lock. When a netlink socket owning a PMSR session closes while an interface tears down concurrently, two kernel threads block each other indefinitely. One thread holds wiphy_lock and waits inside cancel_work_sync(), while the queued work function blocks trying to acquire the same wiphy_lock through guard(wiphy). The result is a kernel deadlock that halts wireless interface operations.

Critical Impact
Local users can trigger a kernel deadlock in the cfg80211 subsystem by racing PMSR socket closure against interface teardown, causing a denial-of-service condition on affected wireless devices.

Affected Products

Linux kernel cfg80211 wireless subsystem (mainline)
Linux stable branches referenced by the kernel.org fix commits
Distributions shipping vulnerable kernels with cfg80211 PMSR support

Discovery Timeline

2026-08-10 - CVE-2026-68408 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68408

Vulnerability Analysis

The vulnerability is a lock-ordering deadlock (a race condition class defect) in the cfg80211 PMSR teardown logic. When a netlink socket owning a PMSR session closes, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to asynchronously invoke cfg80211_pmsr_process_abort(). If the underlying interface tears down concurrently, cfg80211_pmsr_wdev_down() runs under wiphy_lock and calls cancel_work_sync(&pmsr_free_wk) to wait for the pending work to complete. The queued work handler, however, tries to reacquire wiphy_lock via guard(wiphy) before calling process_abort. Neither thread can make progress. The same deadlock path is reachable through cfg80211_leave_locked(), which calls cfg80211_pmsr_wdev_down() for all interface types while already holding wiphy_lock.

Root Cause

The root cause is an incompatible synchronization model between a plain work_struct and the wiphy_lock guard used inside the work handler. cancel_work_sync() blocks until the work item finishes, but the work item itself cannot finish because it needs the very lock the canceling thread holds. The fix converts pmsr_free_wk from a plain work_struct to a wiphy_work. The wiphy_work dispatcher acquires wiphy_lock before running work items, so the explicit guard(wiphy) inside the handler becomes redundant. wiphy_work_cancel() can be called safely while holding wiphy_lock because the lock itself prevents concurrent execution of the work, so cancellation never blocks.

Attack Vector

A local attacker with the ability to open netlink sockets and interact with wireless devices can craft the race condition by starting a PMSR session and triggering interface teardown concurrent with socket closure. Because the deadlock occurs inside the kernel's wireless subsystem while holding wiphy_lock, subsequent operations on the affected wireless PHY stall. The vulnerability requires local access and does not appear to enable code execution or privilege escalation. Reference commits 0a77d9fb, 13368498, 21512b5f, and 2b0eab42 from the kernel.org stable tree provide the corrected synchronization logic.

Detection Methods for CVE-2026-68408

Indicators of Compromise

Kernel task hangs reported by the hung_task watchdog referencing pmsr_free_wk, cfg80211_pmsr_wdev_down, or cfg80211_leave_locked in the stack trace.
Processes blocked in cancel_work_sync() inside cfg80211 code paths visible via /proc/<pid>/stack.
Wireless interfaces (iw, nl80211 clients) becoming unresponsive after PMSR (FTM) session activity.

Detection Strategies

Monitor dmesg and /var/log/kern.log for INFO: task ... blocked for more than N seconds messages associated with wiphy_lock and PMSR functions.
Enable CONFIG_DEBUG_LOCK_ALLOC and lockdep on test systems to surface circular lock dependencies during PMSR teardown testing.
Track kernel version and cfg80211 module version against the fixed commits listed on kernel.org.

Monitoring Recommendations

Alert on repeated hung_task_timeout_secs triggers referencing cfg80211 symbols in production telemetry.
Correlate wireless interface stalls with prior nl80211 PMSR/FTM requests using system audit logs.
Track patch status of Linux kernels across managed endpoints and servers, prioritizing devices with wireless hardware in use.

How to Mitigate CVE-2026-68408

Immediate Actions Required

Apply the upstream Linux kernel patches converting pmsr_free_wk to wiphy_work and removing the redundant cancel_work_sync() from the NETDEV_GOING_DOWN handler.
Update to the stable kernel release incorporating commits 0a77d9fb4d5c, 133684982dd0, 21512b5f7a74, and 2b0eab425e1f.
Restrict local access to systems with wireless interfaces where PMSR functionality is exposed to untrusted users.

Patch Information

The fix is available in the mainline Linux kernel via four commits published on kernel.org: 0a77d9fb, 133684982dd0, 21512b5f, and 2b0eab42. The patch converts pmsr_free_wk from work_struct to wiphy_work, removes the guard(wiphy) inside the work function, and drops the now-unnecessary cancel_work_sync() from the NETDEV_GOING_DOWN handler since cfg80211_leave() already cancels pending work under wiphy_lock.

Workarounds

Disable PMSR/FTM (Fine Timing Measurement) usage in wireless client software until the kernel patch is applied.
Limit the ability of unprivileged users to create nl80211 sockets through appropriate capability restrictions on multi-user hosts.
Rebuild the kernel with the referenced patches backported for distributions that have not yet released updated packages.

bash

# Verify running kernel version and confirm patch inclusion
uname -r
git log --oneline v6.x..HEAD -- net/wireless/pmsr.c net/wireless/core.c