CVE-2026-68405: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock

ieee80211dostop() removes APVLAN packets from the parent AP ps->bcbuf while holding ps->bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb() before dropping the lock.

ieee80211freetxskb() is not just a passive SKB release. For SKBs with TX status state it can report a dropped frame through cfg80211/nl80211, and that path can reach netlink tap transmit. This is the same reason the pending queue cleanup in ieee80211dostop() already unlinks SKBs under the queue lock and frees them after IRQ state is restored.

The buggy scenario involves two paths, with each column showing the order within that path:

APVLAN management TX: APVLAN stop: 1. attach ACK-status state 1. clear the running state 2. queue a multicast SKB on 2. take ps->bcbuf.lock with IRQs parent ps->bcbuf disabled 3. unlink the APVLAN SKB 4. call ieee80211freetxskb()

Unlink matching APVLAN SKBs from ps->bcbuf under the existing lock, but move them to a local free queue. Drop the lock and restore IRQ state before calling ieee80211freetxskb().

WARNING: kernel/softirq.c:430 at localbhenableip