CVE-2026-23336: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: cancel rfkillblock work in wiphyunregister()
There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller:
BUG: KASAN: use-after-free in cfg80211shutdownallinterfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211rfkillblockwork Call Trace: <TASK> dumpstacklvl+0x116/0x1f0 printreport+0xcd/0x630 kasanreport+0xe0/0x110 cfg80211shutdownallinterfaces+0x213/0x220 cfg80211rfkillblockwork+0x1e/0x30 processonework+0x9cf/0x1b70 workerthread+0x6c8/0xf10 kthread+0x3c5/0x780 retfromfork+0x56d/0x700 retfromforkasm+0x1a/0x30 </TASK>
The problem arises due to the rfkillblock work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphyunregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.130.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Cancel the cfg80211 rfkill_block work in wiphy_unregister() before the wiphy is unregistered.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23336?
CVE-2026-23336 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-23336?
To fix CVE-2026-23336, update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-23336?
CVE-2026-23336 affects certain versions of the Linux kernel, particularly those prior to the patch release.
What type of vulnerability is CVE-2026-23336?
CVE-2026-23336 is a use-after-free vulnerability that can lead to system instability.
Is CVE-2026-23336 exploitable?
Yes, CVE-2026-23336 can potentially be exploited to execute arbitrary code or cause a denial of service.