CVE-2026-74661 Overview
CVE-2026-74661 is a use-after-free vulnerability in the Linux kernel's mac802154 IEEE 802.15.4 wireless subsystem. The flaw resides in mac802154_beacon_worker(), which reads local->beacon_req under Read-Copy-Update (RCU) protection and derives the sub-interface (sdata) from the request. The worker then drops the RCU read lock but continues to use sdata and the embedded wpan_dev. If mac802154_stop_beacons_locked() clears and frees the request during interface teardown, an already-running beacon worker can dereference the freed netdev private area.
Critical Impact
A local attacker with the ability to trigger interface teardown while a beacon worker is running can corrupt kernel memory, resulting in privilege escalation or denial of service.
Affected Products
- Linux kernel builds including the mac802154 subsystem with IEEE 802.15.4 beacon support
- Distributions shipping affected stable kernel branches prior to the fix commits
- Systems with 802.15.4 wireless personal area network (WPAN) hardware or interfaces enabled
Discovery Timeline
- 2026-08-22 - CVE-2026-74661 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74661
Vulnerability Analysis
The defect is a classic use-after-free in kernel worker context. The mac802154_beacon_worker() function protects its initial access to local->beacon_req with an RCU read-side critical section. Inside that section it dereferences the request pointer to obtain the sub-interface data structure (sdata) and the embedded wpan_dev. The worker then exits the RCU critical section but keeps using both objects for subsequent beacon transmission logic.
Interface teardown paths call mac802154_stop_beacons_locked(), which cancels only pending beacon work, clears local->beacon_req, and frees the beacon request. A worker already executing past the RCU unlock is not cancelled by this call. It continues to access the netdev private area that has since been released, producing a use-after-free on kernel memory.
Root Cause
The root cause is an inconsistent object lifetime rule between the RCU-protected request pointer and the derived netdev references. RCU protects the pointer read, not the extended lifetime of the resolved sub-interface across the worker's runtime. The scan worker in the same subsystem already pins the netdev by taking a reference before leaving RCU, but the beacon worker did not follow that pattern.
Attack Vector
Exploitation requires local access and the ability to interact with an 802.15.4 interface, so authenticated local privileges are needed. An attacker races an active beacon operation against interface teardown to force the worker to dereference freed memory. Successful memory reuse of the freed netdev private area may allow controlled writes that escalate to root or crash the kernel.
No public proof-of-concept exploit is listed in the referenced advisories. The fix is distributed across kernel commits 5f26a69, 9d067e5, e5fb0e0, e6cd416, and fe820dc on git.kernel.org.
Detection Methods for CVE-2026-74661
Indicators of Compromise
- Kernel oops or panic messages referencing mac802154_beacon_worker, ieee802154, or wpan_dev in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads or writes within net/mac802154/ on hosts running debug kernels
- Unexpected crashes or reboots correlated with iwpan or nl802154 interface bring-up and teardown sequences
Detection Strategies
- Audit installed kernel versions across the fleet and compare against distribution advisories referencing the five upstream fix commits
- Monitor auditd events for netlink operations targeting the 802.15.4 (NL802154) family from unprivileged or non-administrative user contexts
- Correlate kernel crash telemetry with recent WPAN interface state changes to surface race-condition exploitation attempts
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized data lake for retention and cross-host correlation
- Alert on repeated mac802154 subsystem faults on the same host, which may indicate exploitation attempts rather than benign crashes
- Track loading of the mac802154 and ieee802154 modules on hosts that do not require WPAN functionality
How to Mitigate CVE-2026-74661
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 5f26a690, 9d067e5, e5fb0e0, e6cd416, and fe820dc from your distribution vendor
- Reboot affected systems after patching to ensure the fixed kernel is active
- Restrict local shell and CAP_NET_ADMIN privileges on systems that expose 802.15.4 interfaces
Patch Information
The fix applies the same lifetime rule already used by the scan worker: the beacon worker now takes a netdev reference while the request is still protected by RCU and releases it on every path that continues after the reference is acquired. This ensures the netdev private area cannot be freed while the worker is still using it. Patch commits are available from Kernel Git Commit 5f26a69, Kernel Git Commit 9d067e5, Kernel Git Commit e5fb0e0, Kernel Git Commit e6cd416, and Kernel Git Commit fe820dc.
Workarounds
- Blacklist the mac802154 and ieee802154 kernel modules on hosts that do not require 802.15.4 wireless personal area network functionality
- Remove or disable 802.15.4 hardware interfaces to eliminate the code path until patching completes
- Limit local user accounts and enforce least-privilege policies so untrusted users cannot invoke WPAN netlink operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
