Executive brief
The Linux kernel's 802.15.4 wireless networking stack has a memory safety bug in its network interface scanning routine. When a scan operation races with interface deletion, the scan code can access a network interface that has already been freed from memory, potentially causing a system crash or kernel panic. This affects systems using IEEE 802.15.4 wireless devices (low-power mesh networks, IoT devices).
Technical details
The vulnerability is a use-after-free (KASAN slab-use-after-free) in mac802154_scan_worker() within the mac802154 subsystem. The root cause is that the worker function captures a network device interface pointer under RCU lock but continues to dereference it after releasing the RCU lock and outside the rtnl (networking lock), with no additional reference counting. A concurrent DEL_INTERFACE or PHY removal can unregister and asynchronously free the netdev via netdev_run_todo() while the worker is still running. The vulnerability is triggered by racing TRIGGER_SCAN against DEL_INTERFACE, both requiring CAP_NET_ADMIN capability. The fix holds the netdev reference using netdev_hold()/netdev_put() across the worker execution to prevent premature deallocation.
Affected products
- Linux Linux kernel all versions with mac802154 support; fixed in stable branches via commit 234e5e898b713bc0b3a631b6f002897f43d046c8
Timeline
- 2026-08-10: disclosed
- 2026-07-23: patched