{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock  ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps-\u003ebc_buf while holding ps-\u003ebc_buf.lock with IRQs disabled. It then calls ieee80211_free_txskb() before dropping the lock.  ieee80211_free_txskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored.  The buggy scenario involves two paths, with each column showing the order within that path:  AP_VLAN management TX:             AP_VLAN stop: 1. attach ACK-status state         1. clear the running state 2. queue a multicast SKB on        2. take ps-\u003ebc_buf.lock with IRQs    parent ps-\u003ebc_buf                  disabled                                    3. unlink the AP_VLAN SKB                                    4. call ieee80211_free_txskb()  Unlink matching AP_VLAN SKBs from ps-\u003ebc_buf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211_free_txskb().  WARNING: kernel/softirq.c:430 at __local_bh_enable_ip",
  "id": "DEBIAN-CVE-2026-68405",
  "modified": "2026-09-14T16:47:34.144284780Z",
  "published": "2026-08-10T13:20:34.053Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68405"
    }
  ],
  "upstream": [
    "CVE-2026-68405"
  ]
}