CVE-2026-68404 wifi: cfg80211: use wiphy work for socket owner autodisconnect
A race condition in the Linux kernel WiFi subsystem can lead to a use-after-free or crash when a socket is released during device teardown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68404?
CVE-2026-68404 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: use wiphy work for socket owner autodisconnect
nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.
That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader.
Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern.
Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Weakness: CWE-662
Which versions are affected by CVE-2026-68404?
How do I fix CVE-2026-68404?
Apply the vendor's patch.
Is CVE-2026-68404 being exploited?
There is no known exploitation of CVE-2026-68404 in the wild and no public exploit code.
Sources
Also known as AZL-95021, BELL-CVE-2026-68404, DEBIAN-CVE-2026-68404, GHSA-qhv7-v7h4-97x3, UBUNTU-CVE-2026-68404.