CVE-2026-68414

The KASAN trace is conclusive: cfg80211_sched_scan_results_wk is executing against freed rdev state. The work item queues, the workqueue starts executing, and it reads the rdev pointer at the moment cfg80211_dev_free() has already released it. This is not a theoretical race condition with improbable timing. The exploitation window is the gap between wiphy_unregister() completing its drain of other work items and cfg80211_dev_free() destroying the object — bounded by CPU scheduling on the workqueue thread, which is deterministic from the kernel's perspective. The analytical problem is the systematic exclusion. The unregister path correctly cancels multiple other work items but omits sched_scan_res_wk. This suggests the scheduled scan result work item was either added after the drain pattern was established, or it was considered safe through an assumption that has now been disproven. The CVSS 7.5 rating conflates severity with likelihood. The actual risk is narrower: this bug manifests only during device unregistration — module unloading, hot-plug removal, driver rebinding. Whether it's exploitable depends on whether any userspace tool triggers scheduled scan requests and rapidly unregisters the wiphy before results are delivered. But the deeper issue is architectural, not chronological. cfg80211 gives developers no friction when adding new work items — there is no static check, no convention, no guardrail requiring new rdev work items to be added to the drain list in wiphy_unregister(). The safe path and the dangerous path look identical until something explodes under KASAN. Each reactive fix adds a missing cancel_work_sync() but doesn't prevent the next work item from hitting the same gap. That's why cfg80211 has accumulated this exact class of bug multiple times. The patch fixes this instance. The question is whether anyone is extracting the pattern into a durable constraint that prevents the next cfg80211 work item from slipping through.

Reviewed through automated stages and approved by a human before publication.