{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: cfg80211: cancel sched scan results work on unregister  cfg80211_sched_scan_results() can queue rdev-\u003esched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list.  wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unregister/free boundary and access freed rdev state.  The buggy scenario involves two paths, with each column showing the order within that path:  scheduled-scan result path:        unregister/free path: 1. cfg80211_sched_scan_results()   1. interface teardown stops and    queues rdev-\u003esched_scan_res_wk.    removes the scheduled scan request. 2. cfg80211_wq starts the work     2. wiphy_unregister() drains other    item and recovers rdev.            rdev work items. 3. The worker locks rdev-\u003ewiphy    3. cfg80211_dev_free() destroys and    and walks rdev state.              frees rdev.  Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev work items. cancel_work_sync() removes a pending result notification and waits for an already running callback, so cfg80211_dev_free() cannot free rdev while this work item is still active.  Validation reproduced this kernel report: BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530 Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211] Read of size 8 Call trace:   dump_stack_lvl+0x66/0xa0   print_report+0xce/0x630   cfg80211_sched_scan_results_wk+0x4a6/0x530   srso_alias_return_thunk+0x5/0xfbef5   __virt_addr_valid+0x224/0x430   kasan_report+0xac/0xe0   lockdep_hardirqs_on_prepare+0xea/0x1a0   process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212)   lock_is_held_type+0x8f/0x100   worker_thread+0x5ad/0xfd0   __kthread_parkme+0xc6/0x200   kthread+0x31e/0x410   trace_hardirqs_on+0x1a/0x170   ret_from_fork+0x576/0x810   __switch_to+0x57e/0xe20   __switch_to_asm+0x33/0x70   ret_from_fork_asm+0x1a/0x30",
  "id": "DEBIAN-CVE-2026-68414",
  "modified": "2026-09-14T16:47:44.563567233Z",
  "published": "2026-08-10T13:20:35.117Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68414"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-68414"
  ]
}