CVE-2026-68414 (GCVE-0-2026-68414)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-19 16:35
VLAI
Title
wifi: cfg80211: cancel sched scan results work on unregister
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list. wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unregister/free boundary and access freed rdev state. The buggy scenario involves two paths, with each column showing the order within that path: scheduled-scan result path: unregister/free path: 1. cfg80211_sched_scan_results() 1. interface teardown stops and queues rdev->sched_scan_res_wk. removes the scheduled scan request. 2. cfg80211_wq starts the work 2. wiphy_unregister() drains other item and recovers rdev. rdev work items. 3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and and walks rdev state. frees rdev. Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev work items. cancel_work_sync() removes a pending result notification and waits for an already running callback, so cfg80211_dev_free() cannot free rdev while this work item is still active. Validation reproduced this kernel report: BUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530 Workqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211] Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 cfg80211_sched_scan_results_wk+0x4a6/0x530 srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x224/0x430 kasan_report+0xac/0xe0 lockdep_hardirqs_on_prepare+0xea/0x1a0 process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212) lock_is_held_type+0x8f/0x100 worker_thread+0x5ad/0xfd0 __kthread_parkme+0xc6/0x200 kthread+0x31e/0x410 trace_hardirqs_on+0x1a/0x170 ret_from_fork+0x576/0x810 __switch_to+0x57e/0xe20 __switch_to_asm+0x33/0x70 ret_from_fork_asm+0x1a/0x30
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0 (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < b51b42b974461fd0f688baad85f10e2b8ab215c5 (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < 3368457b4871ae8f0f88d19c9a3e6270e850ede6 (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < 308ffdf575560d7e7b8b21f1e3ca6276630f73bf (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < 9293574ac208d18c11073538851fb69355beb3b5 (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < b119c70b24776c8ab2a2c0515397b3b0ad4e66cd (git)
Affected: 807f8a8c300435d5483e8d78df9dcdbc27333166 , < edf0730be33696a1bd142792830d392129e495cc (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.0
Unaffected: 0 , < 3.0 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "b51b42b974461fd0f688baad85f10e2b8ab215c5",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "3368457b4871ae8f0f88d19c9a3e6270e850ede6",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "308ffdf575560d7e7b8b21f1e3ca6276630f73bf",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "9293574ac208d18c11073538851fb69355beb3b5",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "b119c70b24776c8ab2a2c0515397b3b0ad4e66cd",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            },
            {
              "lessThan": "edf0730be33696a1bd142792830d392129e495cc",
              "status": "affected",
              "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel sched scan results work on unregister\n\ncfg80211_sched_scan_results() can queue rdev-\u003esched_scan_res_wk from a\ndriver result notification while a scheduled scan request is present. The\nwork callback recovers the containing cfg80211_registered_device and then\nlocks the wiphy and walks the scheduled-scan request list.\n\nwiphy_unregister() already makes the wiphy unreachable and drains rdev work\nitems before cfg80211_dev_free() can release the object, but it does not\ndrain sched_scan_res_wk. A queued or running result work item can therefore\ncross the unregister/free boundary and access freed rdev state.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nscheduled-scan result path:        unregister/free path:\n1. cfg80211_sched_scan_results()   1. interface teardown stops and\n   queues rdev-\u003esched_scan_res_wk.    removes the scheduled scan request.\n2. cfg80211_wq starts the work     2. wiphy_unregister() drains other\n   item and recovers rdev.            rdev work items.\n3. The worker locks rdev-\u003ewiphy    3. cfg80211_dev_free() destroys and\n   and walks rdev state.              frees rdev.\n\nCancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev\nwork items. cancel_work_sync() removes a pending result notification and\nwaits for an already running callback, so cfg80211_dev_free() cannot free\nrdev while this work item is still active.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530\nWorkqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  cfg80211_sched_scan_results_wk+0x4a6/0x530\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x224/0x430\n  kasan_report+0xac/0xe0\n  lockdep_hardirqs_on_prepare+0xea/0x1a0\n  process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212)\n  lock_is_held_type+0x8f/0x100\n  worker_thread+0x5ad/0xfd0\n  __kthread_parkme+0xc6/0x200\n  kthread+0x31e/0x410\n  trace_hardirqs_on+0x1a/0x170\n  ret_from_fork+0x576/0x810\n  __switch_to+0x57e/0xe20\n  __switch_to_asm+0x33/0x70\n  ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The work item is queued from driver PNO/background-scan match notifications that are produced by received 802.11 frames, so an attacker within WiFi range can drive cfg80211_sched_scan_results() by beaconing SSIDs matching the device\u0027s scheduled-scan match set. This is 802.11 frame injection, i.e. adjacent network reach.\nAC:H - The UAF requires the result-notification work to be queued or running exactly while wiphy_unregister()/cfg80211_dev_free() tears the rdev down; the attacker can drive and time the result notifications but cannot force the device-removal/module-unload half of the race, which is a condition outside their control.\nPR:N - No credentials or association are needed \u2014 an unauthenticated attacker in range simply transmits beacons/probe responses matching the scheduled scan already running on the victim (started by the system\u0027s normal wpa_supplicant/NetworkManager PNO), and the driver notifies cfg80211 unconditionally.\nUI:N - Scheduled scan runs continuously in the background on typical laptop, phone and embedded WiFi deployments, and the unregister side is a system/device event; no victim action such as opening a file or mounting anything is required.\nS:U - The freed object and all corrupted state are cfg80211 kernel structures, so the impact stays within the kernel\u0027s own security authority with no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The worker reads freed rdev memory and then feeds freed scheduled-scan request contents into nl80211_send_sched_scan(), leaking reclaimed slab data to userspace netlink listeners; a controlled reallocation of the freed rdev gives an arbitrary-read style disclosure primitive.\nI:H - After the free the worker performs writes into the freed object \u2014 mutex_lock on rdev-\u003ewiphy.mtx, spin_lock on rdev-\u003ebss_lock, clearing req-\u003ereport_results, and list/refcount manipulation in __cfg80211_bss_expire() \u2014 which corrupts whatever object reclaims the slab and is leverageable for control-flow hijack via heap spraying.\nA:H - The confirmed KASAN use-after-free in cfg80211_sched_scan_results_wk() corrupts and dereferences freed memory from a workqueue context, reliably producing an oops/panic and taking down the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:12.312Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b51b42b974461fd0f688baad85f10e2b8ab215c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3368457b4871ae8f0f88d19c9a3e6270e850ede6"
        },
        {
          "url": "https://git.kernel.org/stable/c/308ffdf575560d7e7b8b21f1e3ca6276630f73bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9293574ac208d18c11073538851fb69355beb3b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b119c70b24776c8ab2a2c0515397b3b0ad4e66cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf0730be33696a1bd142792830d392129e495cc"
        }
      ],
      "title": "wifi: cfg80211: cancel sched scan results work on unregister",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68414",
    "datePublished": "2026-08-10T12:04:34.459Z",
    "dateReserved": "2026-07-30T09:28:09.391Z",
    "dateUpdated": "2026-08-19T16:35:12.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68414",
      "date": "2026-09-21",
      "epss": "0.0023",
      "percentile": "0.14032"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b51b42b974461fd0f688baad85f10e2b8ab215c5",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3368457b4871ae8f0f88d19c9a3e6270e850ede6",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "308ffdf575560d7e7b8b21f1e3ca6276630f73bf",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9293574ac208d18c11073538851fb69355beb3b5",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b119c70b24776c8ab2a2c0515397b3b0ad4e66cd",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "edf0730be33696a1bd142792830d392129e495cc",
                    "status": "affected",
                    "version": "807f8a8c300435d5483e8d78df9dcdbc27333166",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.0"
                  },
                  {
                    "lessThan": "3.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel sched scan results work on unregister\n\ncfg80211_sched_scan_results() can queue rdev-\u003esched_scan_res_wk from a\ndriver result notification while a scheduled scan request is present. The\nwork callback recovers the containing cfg80211_registered_device and then\nlocks the wiphy and walks the scheduled-scan request list.\n\nwiphy_unregister() already makes the wiphy unreachable and drains rdev work\nitems before cfg80211_dev_free() can release the object, but it does not\ndrain sched_scan_res_wk. A queued or running result work item can therefore\ncross the unregister/free boundary and access freed rdev state.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nscheduled-scan result path:        unregister/free path:\n1. cfg80211_sched_scan_results()   1. interface teardown stops and\n   queues rdev-\u003esched_scan_res_wk.    removes the scheduled scan request.\n2. cfg80211_wq starts the work     2. wiphy_unregister() drains other\n   item and recovers rdev.            rdev work items.\n3. The worker locks rdev-\u003ewiphy    3. cfg80211_dev_free() destroys and\n   and walks rdev state.              frees rdev.\n\nCancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev\nwork items. cancel_work_sync() removes a pending result notification and\nwaits for an already running callback, so cfg80211_dev_free() cannot free\nrdev while this work item is still active.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530\nWorkqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  cfg80211_sched_scan_results_wk+0x4a6/0x530\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x224/0x430\n  kasan_report+0xac/0xe0\n  lockdep_hardirqs_on_prepare+0xea/0x1a0\n  process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212)\n  lock_is_held_type+0x8f/0x100\n  worker_thread+0x5ad/0xfd0\n  __kthread_parkme+0xc6/0x200\n  kthread+0x31e/0x410\n  trace_hardirqs_on+0x1a/0x170\n  ret_from_fork+0x576/0x810\n  __switch_to+0x57e/0xe20\n  __switch_to_asm+0x33/0x70\n  ret_from_fork_asm+0x1a/0x30"
          }
        ],
        "id": "CVE-2026-68414",
        "lastModified": "2026-08-19T17:20:49.063",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:35.117",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/308ffdf575560d7e7b8b21f1e3ca6276630f73bf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3368457b4871ae8f0f88d19c9a3e6270e850ede6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9293574ac208d18c11073538851fb69355beb3b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b119c70b24776c8ab2a2c0515397b3b0ad4e66cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b51b42b974461fd0f688baad85f10e2b8ab215c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/edf0730be33696a1bd142792830d392129e495cc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:29:09+00:00",
      "cve": "CVE-2026-68414",
      "id": "CVE-2026-68414",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: cancel sched scan results work on unregister",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68414.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:30:29Z",
      "cve": "CVE-2026-68414",
      "id": "CVE-2026-68414",
      "initial_release_date": "2026-08-11T23:46:07Z",
      "product_status:known_affected": "675",
      "product_status:known_not_affected": "56",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68414",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68414.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.