CVE-2026-68409

A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO (Multi-Link Operation) link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU (Read-Copy-Update). This timing issue can lead to a use-after-free vulnerability, where a reader might still access the freed memory. While difficult to exploit in practice, this could potentially lead to system instability or denial of service.

Red Hat has evaluated this vulnerability as an Important severity issue because an unauthenticated adjacent attacker within Wi-Fi range could cause kernel memory corruption or trigger a kernel panic by racing link teardown operations. Exploitation is constrained to systems equipped with active wireless hardware supporting Multi-Link Operation (MLO). Typical enterprise server environments, virtual machines, and cloud instances running Red Hat Enterprise Linux do not configure wireless network interfaces, inherently limiting exposure to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the mac80211 kernel module from loading on systems where wireless networking is not required.

1. Create a configuration file to prevent the module from loading:

echo "install mac80211 /bin/true" > /etc/modprobe.d/disable-mac80211.conf
echo "blacklist mac80211" >> /etc/modprobe.d/disable-mac80211.conf

2. If the module is currently loaded, attempt to remove it:

modprobe -r mac80211

Caveats: Disabling this module will disable wireless network interfaces relying on the mac80211 subsystem.

Warning: If the mac80211 module is currently in use by active network hardware or dependent modules, unloading it will fail, and a system reboot is required for the configuration changes to take effect.