CVE-2026-68409

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.

AC:LAttack complexity, low

The attacker controls both sides of the race — it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block — and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker's influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).

PR:NPrivileges required, none

No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.

UI:NUser interaction, none

Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device's user.

S:UScope, unchanged

The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.

I:HIntegrity impact, high

The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there — an attacker-timed write primitive into arbitrary recycled kernel state.

A:HAvailability impact, high

Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright.