CVE-2026-74661

A flaw was found in the mac802154 component of the Linux kernel. This use-after-free vulnerability allows a local attacker to potentially cause a system crash (denial of service) or execute arbitrary code. The issue arises when the beacon worker attempts to access memory that has already been freed during network interface teardown.

A use after free race exists in the mac802154 beacon worker because it derives sdata and the embedded wpan_dev from local beacon_req under RCU, then drops the RCU read lock and continues using the derived netdev private data. If beacon stop or interface teardown clears the beacon request while the worker is already running, the worker can dereference freed netdev private memory. For the CVSS the PR:L is used for the paranoid score because a local process with delegated network administration or IEEE 802.15.4 management capability may be able to start or stop beaconing and tear down the interface, while full host root is not always required in containerized or service managed deployments. The issue is not directly network reachable and is triggered through local control plane operations rather than packet traffic. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to UAF based memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.