Deadlock Vulnerability in Linux Kernel Affecting Network Interfaces

CVE-2026-68408

What is CVE-2026-68408?

A deadlock vulnerability has been identified in the Linux kernel's handling of network interfaces, specifically within the cfg80211 module. The issue arises when a netlink socket associated with a PMSR session is closed while there is concurrent activity from the interface teardown process. This can lead to a scenario where one thread holds the wiphy_lock while waiting for another to release it, causing both threads to become blocked. The vulnerability has been addressed by modifying the handling of the pmsr_free_wk work item to prevent this deadlock situation. The fix involves transitioning the work item to use wiphy_work, which is specifically designed to run without locking contention issues.

References