CVE-2026-68404wifi: cfg80211: use wiphy work for socket owner autodisconnect
- 7.8HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item. That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader. Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern. Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 23517673b1eecaec95e61dde285220d5a980cf3f
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < c55590e4c69e0fd194df6d20bc35381c201d99e1
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 4087a9ba4ece70297a4174afaa41c0b700302b65
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < c2ddd180bbee766cf7359473d623423ea9485d93
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 6d6123fef5a4af175cc6b6b12a03dd0f3c240b79
- affected bd2522b168847106c1885f0319a2833bdf88bf9a – < 0c2ed186bbe14304415476d6707b747dddcd8583
- affected 4.11
- unaffected < 4.11
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/23517673b1eecaec95e61dde285220d5a980cf3f (opens in a new tab)
- https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1 (opens in a new tab)
- https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65 (opens in a new tab)
- https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93 (opens in a new tab)
- https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79 (opens in a new tab)
- https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55590 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68404)Record last updated .