{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "57588c71177f0bfc08509c2c3a9bfe32850c0786"
            },
            {
              "fixed": "bd7110f0caa32426140ff302a209c53294ef2cfd"
            },
            {
              "fixed": "dd4754194a706163294b6141460101b99082c8c7"
            },
            {
              "fixed": "59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b"
            },
            {
              "fixed": "5f303f622f6bb8907c405e5123a0ab0f70fb0065"
            },
            {
              "fixed": "234e5e898b713bc0b3a631b6f002897f43d046c8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.6.148"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.101"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68126.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: hold an interface reference across the scan worker\n\nmac802154_scan_worker() captures the scanning sub-interface under RCU\nand then keeps dereferencing sdata-\u003edev after rcu_read_unlock() and\noutside the rtnl -- in the failure traces, in\nmac802154_transmit_beacon_req() (skb-\u003edev = sdata-\u003edev), and in the\nend_scan cleanup. Nothing keeps that netdev alive across the worker\niteration.\n\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\nonce the worker drops the rtnl between its two drv_set_channel()\nsections. unregister_netdevice() frees the netdev asynchronously from\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\niteration from dereferencing the freed netdev -- a KASAN\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\nDEL_INTERFACE (both CAP_NET_ADMIN).\n\nPin the netdev with netdev_hold() while the RCU read lock is still held,\nand release it at every worker exit.",
  "id": "CVE-2026-68126",
  "modified": "2026-08-18T03:31:23.059317144Z",
  "published": "2026-08-10T11:58:47.478Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/234e5e898b713bc0b3a631b6f002897f43d046c8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59c1d5463b7bc5a2cdaae27108d1dfd67edc7d1b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5f303f622f6bb8907c405e5123a0ab0f70fb0065"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd7110f0caa32426140ff302a209c53294ef2cfd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dd4754194a706163294b6141460101b99082c8c7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68126.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68126"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "mac802154: hold an interface reference across the scan worker"
}