CVE-2026-72024 (GCVE-0-2026-72024)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
mac802154: remove interfaces with RCU list deletion
Summary
In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local->interfaces under RCU. The bulk hardware teardown path removes entries with list_del(), so an asynchronous transmit completion can follow a poisoned list node in ieee802154_wake_queue(). Use list_del_rcu() as in the single-interface removal path. The following unregister_netdevice() waits for in-flight RCU readers before freeing the netdevice, so no separate grace-period wait is needed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < 72ac5af9ad09662bd0ea91cb8845d490c8ef9c01 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < 2039f27b1a0c997137a5de7f8a3cee0e80fbf952 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < 4bf231f459b542414629b64f63d5cad6701bd07c (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < b91e5248dd7af09b500879a46d22a36b60db3a57 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < c7c031b75218b3ba3014a0f6b9849888994528d6 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < 77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < d8b5b66388a51febe4b8505b0ecd9da15b4ba639 (git)
Affected: 592dfbfc72f5352437c883aa11ab579d10cdb595 , < 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac802154/iface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72ac5af9ad09662bd0ea91cb8845d490c8ef9c01",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "2039f27b1a0c997137a5de7f8a3cee0e80fbf952",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "4bf231f459b542414629b64f63d5cad6701bd07c",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "b91e5248dd7af09b500879a46d22a36b60db3a57",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "c7c031b75218b3ba3014a0f6b9849888994528d6",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "d8b5b66388a51febe4b8505b0ecd9da15b4ba639",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            },
            {
              "lessThan": "539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0",
              "status": "affected",
              "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac802154/iface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: remove interfaces with RCU list deletion\n\nQueue wake, stop, and disable paths walk local-\u003einterfaces under RCU.\nThe bulk hardware teardown path removes entries with list_del(), so an\nasynchronous transmit completion can follow a poisoned list node in\nieee802154_wake_queue().\n\nUse list_del_rcu() as in the single-interface removal path. The following\nunregister_netdevice() waits for in-flight RCU readers before freeing the\nnetdevice, so no separate grace-period wait is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls to transmit on an IEEE 802.15.4 interface and concurrently tear down the mac802154 hardware (e.g., mac802154_hwsim DEL_RADIO or driver unregister); remote 802.15.4 frames do not reach ieee802154_remove_interfaces().\nAC:L - The attacker controls both sides of the race by concurrently sending traffic (sendmmsg on AF_IEEE802154) while deleting the radio/hardware; syzbot reliably reproduced the crash without external timing dependencies.\nPR:L - With mac802154_hwsim loaded, CAP_NET_ADMIN in a user namespace suffices to bring up wpan interfaces, transmit packets, and issue MAC802154_HWSIM_CMD_DEL_RADIO (GENL_UNS_ADMIN_PERM); AF_IEEE802154 sockets also require only namespace CAP_NET_ADMIN/CAP_NET_RAW.\nUI:N - No victim interaction is required; the attacker triggers the race entirely through their own netlink and socket operations without needing another user to perform any action.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same kernel; this is not a VM escape, IOMMU bypass, or cross-security-authority boundary violation.\nC:H - The RCU list walk in ieee802154_wake_queue() dereferences poisoned/freed list nodes (KASAN wild-memory-access at dead000000000218), constituting use-after-free class memory corruption that can expose adjacent kernel heap contents.\nI:H - Corrupted list traversal can pass attacker-influenced sdata/netdev pointers into netif_wake_queue(), enabling heap corruption primitives and potential control-flow hijacking beyond a simple crash.\nA:H - The syzbot reproducer causes a general protection fault kernel oops in ieee802154_release_queue(); the use-after-free class bug can panic or hang the system even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:32.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72ac5af9ad09662bd0ea91cb8845d490c8ef9c01"
        },
        {
          "url": "https://git.kernel.org/stable/c/2039f27b1a0c997137a5de7f8a3cee0e80fbf952"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf231f459b542414629b64f63d5cad6701bd07c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b91e5248dd7af09b500879a46d22a36b60db3a57"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7c031b75218b3ba3014a0f6b9849888994528d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8b5b66388a51febe4b8505b0ecd9da15b4ba639"
        },
        {
          "url": "https://git.kernel.org/stable/c/539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0"
        }
      ],
      "title": "mac802154: remove interfaces with RCU list deletion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72024",
    "datePublished": "2026-08-15T05:51:49.270Z",
    "dateReserved": "2026-08-09T03:40:39.900Z",
    "dateUpdated": "2026-08-17T05:39:32.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72024",
      "date": "2026-09-22",
      "epss": "0.00164",
      "percentile": "0.06053"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mac802154/iface.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "72ac5af9ad09662bd0ea91cb8845d490c8ef9c01",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2039f27b1a0c997137a5de7f8a3cee0e80fbf952",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bf231f459b542414629b64f63d5cad6701bd07c",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b91e5248dd7af09b500879a46d22a36b60db3a57",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7c031b75218b3ba3014a0f6b9849888994528d6",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d8b5b66388a51febe4b8505b0ecd9da15b4ba639",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0",
                    "status": "affected",
                    "version": "592dfbfc72f5352437c883aa11ab579d10cdb595",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mac802154/iface.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: remove interfaces with RCU list deletion\n\nQueue wake, stop, and disable paths walk local-\u003einterfaces under RCU.\nThe bulk hardware teardown path removes entries with list_del(), so an\nasynchronous transmit completion can follow a poisoned list node in\nieee802154_wake_queue().\n\nUse list_del_rcu() as in the single-interface removal path. The following\nunregister_netdevice() waits for in-flight RCU readers before freeing the\nnetdevice, so no separate grace-period wait is needed."
          }
        ],
        "id": "CVE-2026-72024",
        "lastModified": "2026-08-17T06:18:00.067",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:01.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2039f27b1a0c997137a5de7f8a3cee0e80fbf952"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bf231f459b542414629b64f63d5cad6701bd07c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72ac5af9ad09662bd0ea91cb8845d490c8ef9c01"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b91e5248dd7af09b500879a46d22a36b60db3a57"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7c031b75218b3ba3014a0f6b9849888994528d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d8b5b66388a51febe4b8505b0ecd9da15b4ba639"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T17:47:47+00:00",
      "cve": "CVE-2026-72024",
      "id": "CVE-2026-72024",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mac802154: remove interfaces with RCU list deletion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72024.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:31:28Z",
      "cve": "CVE-2026-72024",
      "id": "CVE-2026-72024",
      "initial_release_date": "2026-08-27T00:24:26Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "333",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72024",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72024.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.