CVE-2026-68414

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: cancel sched scan results work on unregister

cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a

driver result notification while a scheduled scan request is present. The

work callback recovers the containing cfg80211_registered_device and then

locks the wiphy and walks the scheduled-scan request list.

wiphy_unregister() already makes the wiphy unreachable and drains rdev work

items before cfg80211_dev_free() can release the object, but it does not

drain sched_scan_res_wk. A queued or running result work item can therefore

cross the unregister/free boundary and access freed rdev state.

The buggy scenario involves two paths, with each column showing the order

within that path:

scheduled-scan result path: unregister/free path:

1. cfg80211_sched_scan_results() 1. interface teardown stops and

queues rdev->sched_scan_res_wk. removes the scheduled scan request.

2. cfg802

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References