CVE-2026-72024mac802154: remove interfaces with RCU list deletion
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local->interfaces under RCU. The bulk hardware teardown path removes entries with list_del(), so an asynchronous transmit completion can follow a poisoned list node in ieee802154_wake_queue(). Use list_del_rcu() as in the single-interface removal path. The following unregister_netdevice() waits for in-flight RCU readers before freeing the netdevice, so no separate grace-period wait is needed.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 592dfbfc72f5352437c883aa11ab579d10cdb595 builds before 72ac5af9ad09662bd0ea91cb8845d490c8ef9c01; from 592dfbfc72f5352437c883aa11ab579d10cdb595 before 2039f27b1a0c997137a5de7f8a3cee0e80fbf952; 592dfbfc72f5352437c883aa11ab579d10cdb595 builds before 4bf231f459b542414629b64f63d5cad6701bd07c; from 592dfbfc72f5352437c883aa11ab579d10cdb595 before b91e5248dd7af09b500879a46d22a36b60db3a57; from 592dfbfc72f5352437c883aa11ab579d10cdb595 before c7c031b75218b3ba3014a0f6b9849888994528d6; 592dfbfc72f5352437c883aa11ab579d10cdb595 builds before 77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054; from 592dfbfc72f5352437c883aa11ab579d10cdb595 before d8b5b66388a51febe4b8505b0ecd9da15b4ba639; 592dfbfc72f5352437c883aa11ab579d10cdb595 builds before 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 | CNA record |
References
- https://git.kernel.org/stable/c/72ac5af9ad09662bd0ea91cb8845d490c8ef9c01
- https://git.kernel.org/stable/c/2039f27b1a0c997137a5de7f8a3cee0e80fbf952
- https://git.kernel.org/stable/c/4bf231f459b542414629b64f63d5cad6701bd07c
- https://git.kernel.org/stable/c/b91e5248dd7af09b500879a46d22a36b60db3a57
- https://git.kernel.org/stable/c/c7c031b75218b3ba3014a0f6b9849888994528d6
- https://git.kernel.org/stable/c/77caf2d6eba7cb94a7ecd7b369a5974fd7d7c054
- https://git.kernel.org/stable/c/d8b5b66388a51febe4b8505b0ecd9da15b4ba639
- https://git.kernel.org/stable/c/539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.