Linux Kernel CVE-2026-68404

The vulnerability is rooted in the Linux kernel's cfg80211 subsystem (net/wireless/nl80211.c), which manages generic 802.11 wireless configuration via the NETLINK_GENERIC family. The core mechanism is the socket-owner autodisconnect feature: when a userspace process opens a NETLINK_GENERIC socket and takes ownership of a wifi connection (setting conn_owner_nlportid), the kernel's nl80211_netlink_notify() is expected to cleanly disconnect the station when that socket is released. The wdev->disconnect_wk work item, implemented as a plain work_struct, is the vehicle for this deferred cleanup. The race arises because NETDEV_GOING_DOWN cancels this work item, but a concurrent NETLINK_URELEASE notifier that already observed conn_owner_nlportid can re-queue it after that cancel completes. Meanwhile, _cfg80211_unregister_wdev() removes the wdev from the RCU-protected device list and calls synchronize_net() - but synchronize_net() only waits for existing RCU readers to complete, not for work items those readers may have enqueued. The result is a use-after-free or dangling-reference condition on the freed wdev structure. The fix converts disconnect_wk to a wiphy_work, which executes under the wiphy mutex, allowing teardown to cancel pending work while holding that mutex and eliminating the cancel-vs-worker locking hazard. Affected CPE: cpe:2.3:a:linux:linux. No CWE was assigned by the reporter, but the root cause class is a concurrent resource lifecycle race (analogous to CWE-362 or CWE-416).