CVE-2026-68405 (GCVE-0-2026-68405)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-19 16:34
VLAI
Title
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free_txskb() before dropping the lock. ieee80211_free_txskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored. The buggy scenario involves two paths, with each column showing the order within that path: AP_VLAN management TX: AP_VLAN stop: 1. attach ACK-status state 1. clear the running state 2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs parent ps->bc_buf disabled 3. unlink the AP_VLAN SKB 4. call ieee80211_free_txskb() Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211_free_txskb(). WARNING: kernel/softirq.c:430 at __local_bh_enable_ip
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < 0d2619e708e2ef02ba1c91642ea261d3f19d8f9a (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < 659a81b62a61440b85e02c09903be861ae7679e5 (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < aa01ef0ebbc3289154229ef58e65baf289eb9789 (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < 962f755a47d7ec3bbf6c709697d7f4c5f798441d (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < a424985c3ef2a87ce6057a853e18d0c441a86be8 (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < 4b8abf43bf34791c99d99dc3be13f897adefc461 (git)
Affected: 397a7a24ef8c2967a3e8090013f9c54714110c48 , < f3858d5b1432098c1936e03d6e03dd0e33facf60 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/iface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d2619e708e2ef02ba1c91642ea261d3f19d8f9a",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "659a81b62a61440b85e02c09903be861ae7679e5",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "aa01ef0ebbc3289154229ef58e65baf289eb9789",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "962f755a47d7ec3bbf6c709697d7f4c5f798441d",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "a424985c3ef2a87ce6057a853e18d0c441a86be8",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "4b8abf43bf34791c99d99dc3be13f897adefc461",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            },
            {
              "lessThan": "f3858d5b1432098c1936e03d6e03dd0e33facf60",
              "status": "affected",
              "version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/iface.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\n\nieee80211_do_stop() removes AP_VLAN packets from the parent AP\nps-\u003ebc_buf while holding ps-\u003ebc_buf.lock with IRQs disabled. It then\ncalls ieee80211_free_txskb() before dropping the lock.\n\nieee80211_free_txskb() is not just a passive SKB release. For SKBs with\nTX status state it can report a dropped frame through cfg80211/nl80211,\nand that path can reach netlink tap transmit. This is the same reason\nthe pending queue cleanup in ieee80211_do_stop() already unlinks SKBs\nunder the queue lock and frees them after IRQ state is restored.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nAP_VLAN management TX:             AP_VLAN stop:\n1. attach ACK-status state         1. clear the running state\n2. queue a multicast SKB on        2. take ps-\u003ebc_buf.lock with IRQs\n   parent ps-\u003ebc_buf                  disabled\n                                   3. unlink the AP_VLAN SKB\n                                   4. call ieee80211_free_txskb()\n\nUnlink matching AP_VLAN SKBs from ps-\u003ebc_buf under the existing lock,\nbut move them to a local free queue. Drop the lock and restore IRQ state\nbefore calling ieee80211_free_txskb().\n\nWARNING: kernel/softirq.c:430 at __local_bh_enable_ip"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:57.265Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d2619e708e2ef02ba1c91642ea261d3f19d8f9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/659a81b62a61440b85e02c09903be861ae7679e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa01ef0ebbc3289154229ef58e65baf289eb9789"
        },
        {
          "url": "https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60"
        }
      ],
      "title": "wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68405",
    "datePublished": "2026-08-10T12:04:25.241Z",
    "dateReserved": "2026-07-30T09:28:09.390Z",
    "dateUpdated": "2026-08-19T16:34:57.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68405",
      "date": "2026-08-20",
      "epss": "0.0022",
      "percentile": "0.12744"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68405\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:34.053\",\"lastModified\":\"2026-08-19T17:20:48.317\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\\n\\nieee80211_do_stop() removes AP_VLAN packets from the parent AP\\nps-\u003ebc_buf while holding ps-\u003ebc_buf.lock with IRQs disabled. It then\\ncalls ieee80211_free_txskb() before dropping the lock.\\n\\nieee80211_free_txskb() is not just a passive SKB release. For SKBs with\\nTX status state it can report a dropped frame through cfg80211/nl80211,\\nand that path can reach netlink tap transmit. This is the same reason\\nthe pending queue cleanup in ieee80211_do_stop() already unlinks SKBs\\nunder the queue lock and frees them after IRQ state is restored.\\n\\nThe buggy scenario involves two paths, with each column showing the\\norder within that path:\\n\\nAP_VLAN management TX:             AP_VLAN stop:\\n1. attach ACK-status state         1. clear the running state\\n2. queue a multicast SKB on        2. take ps-\u003ebc_buf.lock with IRQs\\n   parent ps-\u003ebc_buf                  disabled\\n                                   3. unlink the AP_VLAN SKB\\n                                   4. call ieee80211_free_txskb()\\n\\nUnlink matching AP_VLAN SKBs from ps-\u003ebc_buf under the existing lock,\\nbut move them to a local free queue. Drop the lock and restore IRQ state\\nbefore calling ieee80211_free_txskb().\\n\\nWARNING: kernel/softirq.c:430 at __local_bh_enable_ip\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/iface.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"0d2619e708e2ef02ba1c91642ea261d3f19d8f9a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"659a81b62a61440b85e02c09903be861ae7679e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"aa01ef0ebbc3289154229ef58e65baf289eb9789\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"962f755a47d7ec3bbf6c709697d7f4c5f798441d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"a424985c3ef2a87ce6057a853e18d0c441a86be8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"4b8abf43bf34791c99d99dc3be13f897adefc461\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"397a7a24ef8c2967a3e8090013f9c54714110c48\",\"lessThan\":\"f3858d5b1432098c1936e03d6e03dd0e33facf60\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/iface.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d2619e708e2ef02ba1c91642ea261d3f19d8f9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/659a81b62a61440b85e02c09903be861ae7679e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa01ef0ebbc3289154229ef58e65baf289eb9789\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-13T23:22:19+00:00",
      "cve": "CVE-2026-68405",
      "id": "CVE-2026-68405",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "261",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68405.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-13T16:22:10Z",
      "cve": "CVE-2026-68405",
      "id": "CVE-2026-68405",
      "initial_release_date": "2026-08-13T16:22:10Z",
      "product_status:known_affected": "193",
      "product_status:known_not_affected": "103",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68405",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68405.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.