CVE-2026-74661: mac802154: fix netdev use-after-free in beacon worker

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix netdev use-after-free in beacon worker

mac802154beaconworker() reads local->beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpandev.

mac802154stopbeaconslocked() cancels only pending beacon work, clears local->beaconreq and frees the request. A beacon worker that is already running can therefore continue after interface teardown and dereference the freed netdev private area.

The scan worker already pins the netdev before leaving RCU. Apply the same lifetime rule to the beacon worker: take a netdev reference while the request is still protected by RCU, and release it on all paths that continue after the reference is acquired.

Affected Software

1 affected component

Linux Linux kernel

Event History

Aug 22, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

What condition is required to trigger the use-after-free?

A beacon worker must already be running while the associated mac802154 interface is being torn down. The worker can retain and use the sub-interface and embedded WPAN device after the beacon request has been cleared and freed.

Are systems using mac802154 beacon processing the relevant exposure scope?

The affected path is the mac802154 beacon worker. The issue concerns interface teardown racing with active beacon work; the scan worker is described as already using the required netdev lifetime protection.

What changes in the resolved fix?

The beacon worker takes a netdev reference while the beacon request remains protected by RCU, then releases that reference on every path that continues after acquiring it. This keeps the netdev private area alive while the worker uses the derived interface data.

CVE-2026-74661: mac802154: fix netdev use-after-free in beacon worker

Affected Software

Event History

Frequently Asked Questions

What condition is required to trigger the use-after-free?

Are systems using mac802154 beacon processing the relevant exposure scope?

What changes in the resolved fix?

Company

Resources

Contact

Frequently Asked Questions

What condition is required to trigger the use-after-free?

Are systems using mac802154 beacon processing the relevant exposure scope?

What changes in the resolved fix?