CVE-2026-72024 - Vulnerability Details

- mac802154: remove interfaces with RCU list deletion

Description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: remove interfaces with RCU list deletion

Queue wake, stop, and disable paths walk local->interfaces under RCU.
The bulk hardware teardown path removes entries with list_del(), so an
asynchronous transmit completion can follow a poisoned list node in
ieee802154_wake_queue().

Use list_del_rcu() as in the single-interface removal path. The following
unregister_netdevice() waits for in-flight RCU readers before freeing the
netdevice, so no separate grace-period wait is needed.

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs when the mac802154 driver removes network interfaces using list_del() instead of the RCU‑safe list_del_rcu(). This misuse can leave a freed list node reachable by an asynchronous transmit completion, which may cause kernel memory corruption and potentially lead to a kernel panic. The CVE does not explicitly mention privilege escalation, only memory corruption.

Affected Systems

All Linux kernel versions that include the mac802154 driver and have not incorporated the referenced fix commits are affected. The flaw applies to any generic Linux kernel build that creates and deletes IEEE 802.15.4 wireless interfaces, regardless of vendor.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1 % suggests that exploitation is unlikely. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector requires creating and deleting mac802154 interfaces, implying local or privileged access. While no public exploits are reported, the risk of kernel crash remains significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< 72ac5af9ad09662bd0ea91cb8845d490c8ef9c01
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< 2039f27b1a0c997137a5de7f8a3cee0e80fbf952
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< 4bf231f459b542414629b64f63d5cad6701bd07c
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< b91e5248dd7af09b500879a46d22a36b60db3a57
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< c7c031b75218b3ba3014a0f6b9849888994528d6
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< 77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< d8b5b66388a51febe4b8505b0ecd9da15b4ba639
`592dfbfc72f5352437c883aa11ab579d10cdb595`	affected	< 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[592dfbfc72f5352437c883aa11ab579d10cdb595,72ac5af9ad09662bd0ea91cb8845d490c8ef9c01)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,2039f27b1a0c997137a5de7f8a3cee0e80fbf952)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,4bf231f459b542414629b64f63d5cad6701bd07c)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,539dfcf69105d8d3d677b71de6e5ede2e6dfa0)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,b91e5248dd7af09b500879a46d22a36b60db3a57)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,c7c031b75218b3ba3014a0f6b9849888994528d6)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054)`	affected	code_commit	—
`[592dfbfc72f5352437c883aa11ab579d10cdb595,d8b5b66388a51febe4b8505b0ecd9da15b4ba639)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.19`	affected	generic	—
`[0,3.19)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that incorporates the fix from the referenced commits
If maintaining an older kernel, backport the patch into the current source
If IEEE 802.15.4 interfaces are not required, disable or remove them from the configuration
Continuously monitor kernel logs for BUG or panic messages related to mac802154

Generated by OpenCVE AI on August 18, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2039f27b1a0c997137a5de7f8a3cee0e80fbf952
https://git.kernel.org/stable/c/4bf231f459b542414629b64f63d5cad6701bd07c
https://git.kernel.org/stable/c/539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0
https://git.kernel.org/stable/c/72ac5af9ad09662bd0ea91cb8845d490c8ef9c01
https://git.kernel.org/stable/c/77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054
https://git.kernel.org/stable/c/b91e5248dd7af09b500879a46d22a36b60db3a57
https://git.kernel.org/stable/c/c7c031b75218b3ba3014a0f6b9849888994528d6
https://git.kernel.org/stable/c/d8b5b66388a51febe4b8505b0ecd9da15b4ba639
https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72024-7fde@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72024
https://www.cve.org/CVERecord?id=CVE-2026-72024

History

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72024-7fde@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72024 https://www.cve.org/CVERecord?id=CVE-2026-72024
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local->interfaces under RCU. The bulk hardware teardown path removes entries with list_del(), so an asynchronous transmit completion can follow a poisoned list node in ieee802154_wake_queue(). Use list_del_rcu() as in the single-interface removal path. The following unregister_netdevice() waits for in-flight RCU readers before freeing the netdevice, so no separate grace-period wait is needed.
Title		mac802154: remove interfaces with RCU list deletion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2039f27b1a0c997137a5de7f8a3cee0e80fbf952 https://git.kernel.org/stable/c/4bf231f459b542414629b64f63d5cad6701bd07c https://git.kernel.org/stable/c/539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 https://git.kernel.org/stable/c/72ac5af9ad09662bd0ea91cb8845d490c8ef9c01 https://git.kernel.org/stable/c/77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054 https://git.kernel.org/stable/c/b91e5248dd7af09b500879a46d22a36b60db3a57 https://git.kernel.org/stable/c/c7c031b75218b3ba3014a0f6b9849888994528d6 https://git.kernel.org/stable/c/d8b5b66388a51febe4b8505b0ecd9da15b4ba639

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:49.270Z

Updated: 2026-08-17T05:39:32.685Z

Reserved: 2026-08-09T03:40:39.900Z

Link: CVE-2026-72024

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:01.440

Modified: 2026-08-17T06:18:00.067

Link: CVE-2026-72024

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72024 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:00:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object