UBUNTU-CVE-2026-68404: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify() walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnectwk work item. That work is a plain workstruct today. NETDEVGOINGDOWN cancels it, but a NETLINKURELEASE notifier that already observed connownernlportid can queue it after that cancel returns. cfg80211unregisterwdev() then removes the wdev from the list and waits for RCU readers, but synchronizenet() does not drain work queued by such a reader. Make the autodisconnect work a wiphywork instead. The callback already needs the wiphy mutex, and wiphywork runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancelworksync() vs. worker locking concern. Also cancel the wiphy work after listdelrcu() and synchronizenet(). Any NETLINKURELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the listed Ubuntu Linux kernel packages, including linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle. Exposure is relevant on systems using cfg80211 wireless devices with nl80211-managed connections.
What conditions are needed to trigger the vulnerability?
A NETLINK_GENERIC socket must own a wireless connection, and the socket release notifier must race with wireless-device teardown. The race involves queued autodisconnect work after NETDEV_GOING_DOWN cancellation and removal of the wireless device from the cfg80211 list.
How can I tell whether my environment is potentially affected?
Check whether the running Ubuntu kernel belongs to one of the listed kernel package families and whether the system uses cfg80211/nl80211 wireless networking. The provided information does not include affected or fixed package version numbers.