CVE-2026-74661: mac802154: fix netdev use-after-free in beacon worker
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix netdev use-after-free in beacon worker
mac802154beaconworker() reads local->beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpandev.
mac802154stopbeaconslocked() cancels only pending beacon work, clears local->beaconreq and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What condition is required to trigger the use-after-free?
A beacon worker must already be running while the associated mac802154 interface is being torn down. The worker can retain and use the sub-interface and embedded WPAN device after the beacon request has been cleared and freed.
Are systems using mac802154 beacon processing the relevant exposure scope?
The affected path is the mac802154 beacon worker. The issue concerns interface teardown racing with active beacon work; the scan worker is described as already using the required netdev lifetime protection.
What changes in the resolved fix?
The beacon worker takes a netdev reference while the beacon request remains protected by RCU, then releases that reference on every path that continues after acquiring it. This keeps the netdev private area alive while the worker uses the derived interface data.