Linux Kernel CVE-2026-68404

Exploitation requires: (1) local system access with at least standard user-level privileges (CVSS PR:L); (2) the target system must have a wifi network interface actively managed by a cfg80211-based kernel driver - systems without wireless hardware or without cfg80211 loaded are not affected; (3) an active wifi connection must be established with the attacking process's NETLINK_GENERIC socket set as the connection owner (conn_owner_nlportid populated), which reflects a specific kernel state rather than a default passive condition; (4) the race requires concurrent triggering of NETDEV_GOING_DOWN and NETLINK_URELEASE on the same wireless device, imposing a timing constraint that limits reliable exploitation. Factors limiting exploitation beyond the CVSS raw score include: the need to win a kernel-level race condition, the requirement for wifi hardware and driver presence, and the non-default kernel state of socket-owned connections.

The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full triad impact achievable by a local, low-privilege attacker - a profile consistent with kernel privilege escalation or memory corruption. However, AC:L may overstate exploitability for a race condition that requires two concurrent kernel events (NETLINK_URELEASE and NETDEV_GOING_DOWN) to align; an independent assessment of AC:H is arguably more accurate. EPSS at 0.19% (9th percentile) is very low and corroborates that no widespread exploitation tooling has emerged; the vulnerability is not listed in CISA KEV. Taken together, even a mid-sized municipal IT team in boleslawiec should treat this as a routine patch-cycle priority rather than an emergency response item, given the local-only attack vector, race-condition reliability barrier, and absence of public exploit code. The high C/I/A impact ratings are realistic if the race is won - kernel heap corruption can lead to privilege escalation - but the practical bar for reliably triggering it is non-trivial. No conflicting signals between CVSS and description are observed regarding the local attack vector.

A local user with standard credentials on a wifi-connected Linux system opens a NETLINK_GENERIC socket and acquires ownership of the active wireless connection, causing the kernel to record their socket's port ID in conn_owner_nlportid. The attacker then arranges for the wireless device to begin deregistering (NETDEV_GOING_DOWN) concurrently with releasing the socket (NETLINK_URELEASE), causing the URELEASE notifier to re-queue the autodisconnect work item after GOING_DOWN has already cancelled it; once _cfg80211_unregister_wdev() completes synchronize_net() and frees the wdev structure, the queued work executes against freed memory, potentially yielding kernel heap corruption or privilege escalation. No public proof-of-concept has been identified at time of analysis, and reliably winning this race window is expected to require repeated attempts or specialized kernel timing tools.