Linux Kernel Vulnerability in mac80211 Affecting Link RX Stats

CVE-2026-68409

What is CVE-2026-68409?

A vulnerability in the Linux kernel's mac80211 component allows improper management of link RX stats, where removed MLO links free their stats' percpu buffer immediately, potentially leading to a race condition. The removal of the link container is deferred to a Read-Copy-Update (RCU) call, but without appropriate synchronization, readers holding onto pointers to already-freed statistico blocks may encounter dangling references. This issue complicates the normal teardown process of STA links and violates memory safety practices. The fix involves ensuring that statistics and links are released together within a singular RCU callback to prevent race conditions and enhance overall memory management.

References