{"id":"CVE-2026-68409","state":"PUBLISHED","title":"wifi: mac80211: defer link RX stats percpu free to RCU","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link's RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(&alloc->info);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain.","publishedAt":"2026-08-10T12:04:29.238Z","updatedAt":"2026-10-30T12:28:32.032Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"acd5931d5adf12f0163f83dc00320e7011f4da92","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"a5afc00280986063f1c355821544fabbb2a960f7","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"b679c1cffb2f3d0854b8b05ea9e909ad6489046f","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"2aa1789880fa5e41049b0f6a74a4fc2fa1997610","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"a03fceae0c65b31ce31840dac5e26684ceecb65b","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"aa2eb62525188269cdd402a583b9a8ed94657ff0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/sta_info.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/sta_info.c"]}],"references":["https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92","https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7","https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f","https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610","https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b","https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68409.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68409","state":"PUBLISHED","datePublished":"2026-08-10T12:04:29.238Z","dateUpdated":"2026-10-30T12:28:32.032Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.390Z"},"containers":{"cna":{"title":"wifi: mac80211: defer link RX stats percpu free to RCU","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link's RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(&alloc->info);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"acd5931d5adf12f0163f83dc00320e7011f4da92","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"a5afc00280986063f1c355821544fabbb2a960f7","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"b679c1cffb2f3d0854b8b05ea9e909ad6489046f","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"2aa1789880fa5e41049b0f6a74a4fc2fa1997610","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"a03fceae0c65b31ce31840dac5e26684ceecb65b","versionType":"git"},{"version":"c71420db653aba30a234d1e4cf86dde376e604fa","status":"affected","lessThan":"aa2eb62525188269cdd402a583b9a8ed94657ff0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/sta_info.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/sta_info.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92"},{"url":"https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7"},{"url":"https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f"},{"url":"https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"},{"url":"https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"},{"url":"https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.\nAC:L - The attacker controls both sides of the race — it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block — and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker's influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).\nPR:N - No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.\nUI:N - Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device's user.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.\nI:H - The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there — an attacker-timed write primitive into arbitrary recycled kernel state.\nA:H - Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:28:32.032Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68409","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:48:24.807491Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T21:09:09.046Z"}}]}}}