Skip to main content

Linux Kernel CVE-2026-68409

| EUVDEUVD-2026-55595 HIGH
2026-08-10 Linux GHSA-g5f7-qj4q-4w5v
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race explicitly described as 'hard to win in practice' warrants AC:H; AV:A reflects mandatory WiFi adjacency; PR:N as no network-side authentication is required.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:50 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: defer link RX stats percpu free to RCU

sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU:

sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head);

The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists.

The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU.

Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.

AnalysisAI

Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.

Technical ContextAI

The vulnerability resides in sta_remove_link() within the Linux kernel's net/mac80211 subsystem, which implements IEEE 802.11 (WiFi) MAC-layer logic. MLO (Multi-Link Operation) is a WiFi 7 (802.11be) feature enabling simultaneous operation across multiple frequency bands. The affected structure is link_sta, whose fast RX path is accessed under rcu_read_lock(), writing per-CPU statistics to a pcpu_rx_stats block allocated via alloc_percpu(). sta_remove_link() freed this percpu block immediately via free_percpu() while deferring the enclosing link container via kfree_rcu(). An RCU reader that dereferenced link_sta before removal retains a valid pointer to the container (protected by the RCU grace period from kfree_rcu) but the percpu block the container references is already reclaimed - a classic use-after-free in an RCU-protected data structure. The fix consolidates both the percpu block free and the container free into a single RCU callback, ensuring the percpu memory is only reclaimed after all readers drain. The root cause maps to CWE-416 (Use After Free) with CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) as a contributing factor; no formal CWE is assigned in NVD data. Affected CPE: cpe:2.3:a:linux:linux.

RemediationAI

Upgrade the Linux kernel to 6.18.42, 7.1.6, or 7.2-rc4 or later; all three stable branches contain the fix that moves percpu RX stats deallocation into the same RCU callback as the link container, ensuring memory is reclaimed only after RCU readers drain. Patches are available directly from the upstream stable tree at git.kernel.org (commits 2aa1789880fa, a03fceae0c65, aa2eb62525188). As a compensating control, disabling WiFi 7 MLO functionality - either by using a driver configuration that excludes MLO support or by configuring the wireless interface to operate in single-link mode - will prevent the vulnerable sta_remove_link() code path from executing, though this eliminates the throughput and latency benefits of multi-link operation. Systems using WiFi hardware or drivers without MLO support (i.e., pre-WiFi-7 devices) are not exposed and require no mitigation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68409 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy