Linux Kernel CVE-2026-72024

The mac802154 subsystem implements the IEEE 802.15.4 low-rate wireless personal area network (LR-WPAN) protocol stack in the Linux kernel. RCU (Read-Copy-Update) is a kernel synchronization primitive that allows multiple concurrent readers to traverse shared data structures without locking. The transmit queue management functions ieee802154_wake_queue(), ieee802154_stop_queue(), and ieee802154_disable_queue() iterate over the local->interfaces list while holding an RCU read lock. However, the bulk hardware teardown path (invoked during multi-interface removal) was incorrectly using list_del(), which immediately overwrites the list node's next/prev pointers with a poison value (LIST_POISON1/LIST_POISON2) intended to catch subsequent misuse. A concurrent RCU reader traversing the list after list_del() has been called but before the reader's grace period ends will dereference that poisoned pointer, causing a kernel oops or exploitable use-after-free condition. The correct primitive, list_del_rcu(), defers pointer poisoning until all concurrent RCU readers have exited the critical section; the subsequent unregister_netdevice() call provides the necessary RCU grace period, making an additional synchronize_rcu() call unnecessary. No formal CWE has been assigned, though the root cause maps conceptually to improper synchronization (CWE-362, race condition) and potential use-after-free (CWE-416). The introduced-in commit is 592dfbfc72f5352437c883aa11ab579d10cdb595, present since Linux 3.19.