CVE-2026-68414

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. When a Wi-Fi device is unregistered, the system fails to properly cancel pending scheduled scan results work. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. An attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local access and the removal of a Wi-Fi interface during active scheduled scanning, limiting the blast radius to a system crash without remote exposure. Standard Red Hat Enterprise Linux server deployments do not utilize wireless hardware or scheduled scan operations, significantly reducing overall exposure in enterprise environments. Risk is primarily confined to workstations or specialized platforms with Wi-Fi adapters where an unprivileged local user or process can trigger device unregistration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.