CVE-2026-68409: Linux Kernel Race Condition Vulnerability

CVE-2026-68409 Overview

CVE-2026-68409 is a use-after-free vulnerability in the Linux kernel mac80211 subsystem. The flaw affects Multi-Link Operation (MLO) handling in Wi-Fi stations. When sta_remove_link() removes an MLO link, it frees the receive (RX) stats percpu buffer immediately while deferring only the link container to Read-Copy-Update (RCU). Readers that resolved link_sta before removal retain a pointer to a freed percpu block, creating a race condition on the RX fast path.

Critical Impact
An adjacent-network attacker within Wi-Fi range can trigger memory corruption in the kernel, potentially leading to code execution or denial of service on hosts using MLO with per-CPU RX statistics enabled.

Affected Products

Linux kernel mac80211 subsystem
Kernels with uses_rss enabled where pcpu_rx_stats is allocated
Wi-Fi drivers using MLO link management via sta_remove_link()

Discovery Timeline

2026-08-10 - CVE-2026-68409 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68409

Vulnerability Analysis

The vulnerability resides in the MLO link teardown path within net/mac80211/sta_info.c. When a link is removed, sta_info_free_link() immediately releases the percpu RX statistics buffer allocated for that link. The surrounding container is then queued for deferred release via kfree_rcu(alloc, rcu_head). This split creates an asymmetric lifecycle where the container outlives its data.

The RX fast path resolves link_sta under rcu_read_lock() and writes into the percpu stats block. A reader that dereferenced link_sta prior to removal continues to write to the percpu block after it is freed. The container itself remains alive due to the RCU grace period, masking the underlying corruption until the freed percpu memory is reused.

By contrast, the full STA teardown path frees the deflink stats only after synchronize_net(), ensuring readers have drained. The link removal path lacked this barrier, breaking the RCU invariant.

Root Cause

The root cause is an incomplete RCU deferral in sta_remove_link(). The percpu RX stats buffer is freed synchronously while the container that points to it is freed asynchronously. Concurrent readers on the RX fast path can write to freed memory, producing a classic use-after-free condition. The bug is only reachable when uses_rss is set, which is the condition under which pcpu_rx_stats is allocated.

Attack Vector

Exploitation requires an attacker within adjacent Wi-Fi range of a target running a vulnerable kernel with MLO and receive-side scaling enabled. An attacker can influence link add/remove events by manipulating association state while sustaining RX traffic to keep the fast path active. Winning the race window between the percpu free and the RCU grace period allows corruption of kernel memory, though the race is difficult to trigger reliably in practice.

The upstream fix consolidates the free operation into a single RCU callback so the percpu block is reclaimed only after readers drain. See the kernel commit for the mainline fix for the implementation details.

Detection Methods for CVE-2026-68409

Indicators of Compromise

Kernel oops or panic traces referencing mac80211, sta_info_free_link, or ieee80211_rx under load with MLO clients
KASAN use-after-free reports pointing to pcpu_rx_stats allocations
Unexpected Wi-Fi interface resets or driver watchdog resets on hosts with MLO peers

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the use-after-free during link removal under RX load
Monitor dmesg and journald for mac80211 warnings correlated with STA link add/remove events
Track kernel version and CONFIG_MAC80211 build options across the fleet to identify unpatched hosts

Monitoring Recommendations

Collect kernel logs centrally and alert on BUG:, KASAN, or general protection fault entries referencing net/mac80211
Baseline Wi-Fi link flap rates and investigate anomalous MLO link churn from adjacent clients
Inventory devices running kernels prior to the fix commits to prioritize patching

How to Mitigate CVE-2026-68409

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits for this CVE
Update to a distribution kernel that includes the mac80211 link RCU fix
Restrict physical proximity and enforce WPA3 or enterprise authentication on Wi-Fi networks to reduce exposure to adjacent attackers

Patch Information

The fix consolidates the link and its percpu data into a single RCU callback, ensuring the percpu block is reclaimed only after RCU readers drain. Patches are available in the following stable tree commits: commit 2aa1789880fa, commit a03fceae0c65, and commit aa2eb6252518.

Workarounds

Disable MLO on affected Wi-Fi drivers until patches can be applied
Disable receive-side scaling (uses_rss) in driver configuration to avoid allocating pcpu_rx_stats, removing the vulnerable code path
Segment untrusted wireless clients onto isolated SSIDs and VLANs to reduce adjacent-network exposure

bash

# Verify kernel version and mac80211 module status
uname -r
modinfo mac80211 | grep -E 'version|filename'

# Check whether MLO/RSS is active on wireless interfaces
iw dev
iw phy | grep -i 'MLO\|multi-link'