EUVD-2026-64348
GHSA-6r5m-rv77-x5qr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between worker and teardown path requires precise timing (AC:H); local low-privilege access needed to manage 802.15.4 interface (PR:L, AV:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix netdev use-after-free in beacon worker
mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpan_dev.
mac802154_stop_beacons_locked() cancels only pending beacon work, clears local->beacon_req and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.
AnalysisAI
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the mac802154 kernel module to be loaded and an IEEE 802.15.4 network interface to be present and operational - this is a non-default hardware-dependent configuration absent on most general-purpose systems; (2) an active beacon request submitted to the interface so that mac802154_beacon_worker() is scheduled or running; (3) concurrent triggering of interface teardown via mac802154_stop_beacons_locked() to race against the running worker - this is a timing-dependent race condition requiring multiple attempts; (4) local system access with at least CAP_NET_ADMIN or equivalent privilege to manage network interfaces (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity with full kernel confidentiality, integrity, and availability impact - consistent with a kernel UAF that can escalate to arbitrary code execution in ring 0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privileged account on a system with mac802154 hardware configures a 802.15.4 interface to transmit beacons, then triggers concurrent interface teardown (e.g., by repeatedly cycling the interface state) while the beacon worker is active. By winning the race between mac802154_beacon_worker() resuming after the RCU lock drop and mac802154_stop_beacons_locked() freeing the beacon request structure, the attacker causes the worker to dereference the freed netdev private area, potentially enabling kernel memory corruption leading to local privilege escalation. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 6.6.152 or later, 6.12.104 or later, 6.18.45 or later, or 7.1.9 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, assess which systems in your environment use mac802154 or IEEE 802.15.4 hardware and create a prioritized patching list. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today