CVE-2026-97595

A flaw was found in the Linux kernel's mac802154 wireless network subsystem. A lack of proper locking and reference counting allows queued incoming frames to reference network interface data after the interface has been deleted, resulting in a use-after-free vulnerability. An attacker could exploit this timing issue by flooding an interface with network frames while it is being removed, leading to a Denial of Service (DoS) via a kernel crash or potential memory corruption.

mac802154 queues beacon and MAC command frames while retaining raw sdata and skb dev pointers without holding a netdev reference. A queued worker can dereference the interface after teardown has freed its private data, producing a confirmed slab use after free. Concurrent list insertion from RX softirq and deletion by process context workers can also corrupt the shared RX lists. An adjacent attacker may contribute to the trigger by flooding crafted or repeated IEEE 802.15.4 MAC command or beacon frames while the affected interfaces are active or being removed. For the CVSS the PR:N is selected because a radio adjacent sender does not need a local account or privileges on the target. AV:A is used because exploitation requires access to the local IEEE 802.15.4 communication environment rather than general Internet reachability. AC:H reflects the required timing between frame reception, deferred worker execution, and interface teardown or concurrent list access. Impact is at least denial of service through a kernel crash or stalled interface removal. The confirmed UAF and possible list corruption may also permit confidentiality or integrity impact and should be reviewed for potential privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.