CVE-2026-68404 - Vulnerability Details

- wifi: cfg80211: use wiphy work for socket owner autodisconnect

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: use wiphy work for socket owner autodisconnect

nl80211_netlink_notify() walks the cfg80211 wireless device list when a
NETLINK_GENERIC socket is released. If the socket owns a connection, the
notifier queues the embedded wdev->disconnect_wk work item.

That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a
NETLINK_URELEASE notifier that already observed conn_owner_nlportid can
queue it after that cancel returns. _cfg80211_unregister_wdev() then
removes the wdev from the list and waits for RCU readers, but
synchronize_net() does not drain work queued by such a reader.

Make the autodisconnect work a wiphy_work instead. The callback already
needs the wiphy mutex, and wiphy_work runs under that mutex. This lets
teardown cancel pending autodisconnect work while holding the mutex,
without a cancel_work_sync() vs. worker locking concern.

Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any
NETLINK_URELEASE notifier that had already reached the wdev list has then
either queued the work and it is removed, or can no longer find the wdev.

Published: 2026-08-10

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel cfg80211 wireless subsystem can cause an AUTODISCONNECT work item to be queued after its owning device structure has been removed, leading to a use-after-free that can crash the kernel and result in a denial of service. The flaw is catalogued as CWE-367 (Race Condition) and CWE-662 (Use After Free). To trigger the bug, an attacker must be able to open and close NETLINK sockets that interact with cfg80211, making this a local-access vulnerability.

Affected Systems

All Linux kernel distributions that include cfg80211; in practice this is every kernel that supports wireless networking. No specific kernel version is listed in the advisory.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. No public exploits are known and the vulnerability is not yet in the CISA KEV catalog. Because the attacker needs local access to create and close NETLINK sockets, the attack vector is local and would lead to a denial of service rather than privilege escalation or remote code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd2522b168847106c1885f0319a2833bdf88bf9a`	affected	< c55590e4c69e0fd194df6d20bc35381c201d99e1
`bd2522b168847106c1885f0319a2833bdf88bf9a`	affected	< 4087a9ba4ece70297a4174afaa41c0b700302b65
`bd2522b168847106c1885f0319a2833bdf88bf9a`	affected	< c2ddd180bbee766cf7359473d623423ea9485d93
`bd2522b168847106c1885f0319a2833bdf88bf9a`	affected	< 6d6123fef5a4af175cc6b6b12a03dd0f3c240b79
`bd2522b168847106c1885f0319a2833bdf88bf9a`	affected	< 0c2ed186bbe14304415476d6707b747dddcd8583

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bd2522b168847106c1885f0319a2833bdf88bf9a,6d6123fef5a4af175cc6b6b12a03dd0f3c240b79)`	affected	code_commit	—
`[bd2522b168847106c1885f0319a2833bdf88bf9a,0c2ed186bbe14304415476d6707b747dddcd8583)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch identified by commit 0c2ed186bbe14304415476d6707b747dddcd8583.
Reboot the system so the updated kernel takes effect.
If an immediate kernel update cannot be performed, disable wireless interfaces or restrict NETLINK_GENERIC socket usage that interacts with cfg80211 until remediation is applied.

Generated by OpenCVE AI on October 20, 2026 at 11:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583
https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65
https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79
https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93
https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1
https://nvd.nist.gov/vuln/detail/CVE-2026-68404
https://www.cve.org/CVERecord?id=CVE-2026-68404

History

Wed, 21 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65 https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-662

Sat, 17 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93

Thu, 13 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 12 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-399

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68404 https://www.cve.org/CVERecord?id=CVE-2026-68404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-399

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item. That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader. Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern. Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Title		wifi: cfg80211: use wiphy work for socket owner autodisconnect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583 https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:04:24.241Z

Updated: 2026-10-21T12:44:01.037Z

Reserved: 2026-07-30T09:28:09.390Z

Link: CVE-2026-68404

Vulnrichment

Updated: 2026-10-16T15:48:21.765Z

NVD

Status : Received

Published: 2026-08-10T13:20:33.947

Modified: 2026-10-21T13:19:29.537

Link: CVE-2026-68404

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:04:24Z

Links: CVE-2026-68404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T11:15:14Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-662
Improper Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object