CVE-2026-68404
wifi: cfg80211: use wiphy work for socket owner autodisconnect
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item. That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader. Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern. Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 23517673b1eecaec95e61dde285220d5a980cf3f
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < c55590e4c69e0fd194df6d20bc35381c201d99e1
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 4087a9ba4ece70297a4174afaa41c0b700302b65
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < c2ddd180bbee766cf7359473d623423ea9485d93
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 6d6123fef5a4af175cc6b6b12a03dd0f3c240b79
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 0c2ed186bbe14304415476d6707b747dddcd8583
- affected 4.11
- unaffected < 4.11
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References (6)
- https://git.kernel.org/stable/c/23517673b1eecaec95e61dde285220d5a980cf3f (opens in a new tab)
- https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1 (opens in a new tab)
- https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65 (opens in a new tab)
- https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93 (opens in a new tab)
- https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79 (opens in a new tab)
- https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-68404)Record last updated .