CVE-2026-68404

This vulnerability exposes a subtle semantic gap in kernel synchronization that static analysis tools cannot catch and that code review typically misses: synchronize_net() provides RCU read-side guarantees for device list traversal, but it does not drain work_struct items that those readers might have queued. The race condition isn't a logic error in any single function — it's an emergent property of three separately-correct synchronization paths intersecting at their seams. The specific failure: NETLINK_URELEASE notifiers can observe a socket's conn_owner_nlportid before NETDEV_GOING_DOWN cancels the associated work_struct, creating a window where the notifier queues new work that escapes the subsequent synchronize_net() barrier. Each component follows established kernel patterns in isolation — the disconnect work queue, the RCU grace period, and the device list removal all look correct. The vulnerability appears at their intersection. The fix addresses this directly: converting to wiphy_work collapses the three synchronization concerns (work cancellation, RCU grace period, and device removal) into a single mutex boundary that the teardown path already holds. This eliminates the semantic gap entirely — the wiphy mutex serializes work queuing against teardown, making the race impossible. The additional cancel after list_del_rcu() provides defense-in-depth for the residual window during the brief interval between list removal and mutex acquisition. Audit your own code for this pattern: any path that walks device lists from notifier contexts, queues work from those readers, and relies on synchronize_net() for teardown has the same vulnerability. The cfg80211 subsystem likely has related interactions, but the pattern — synchronize_net() as an incomplete quiescence guarantee when work deferral is involved — is not cfg80211-specific. It represents a class of synchronization gaps that have appeared in multiple kernel subsystems over the past decade.

Reviewed through automated stages and approved by a human before publication.