CVE-2026-68126: mac802154: hold an interface reference across the scan worker

In the Linux kernel, the following vulnerability has been resolved:

mac802154: hold an interface reference across the scan worker

mac802154scanworker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcureadunlock() and outside the rtnl -- in the failure traces, in mac802154transmitbeaconreq() (skb->dev = sdata->dev), and in the endscan cleanup. Nothing keeps that netdev alive across the worker iteration.

A concurrent DELINTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drvsetchannel() sections. unregisternetdevice() frees the netdev asynchronously from netdevruntodo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154ISSCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGERSCAN against DELINTERFACE (both CAPNETADMIN).

Pin the netdev with netdevhold() while the RCU read lock is still held, and release it at every worker exit.