Executive brief
The Linux kernel's 802.15.4 MAC layer (mac802154) contains a race condition in hardware teardown that can lead to accessing freed memory. When network interfaces are removed during bulk hardware teardown, the kernel improperly frees list nodes while other code paths are still reading the same list under RCU synchronization, potentially causing system crashes or unpredictable behavior.
Technical details
The vulnerability is a use-after-free in the mac802154 subsystem's interface removal code. The bulk hardware teardown path in ieee802154_remove_interfaces() was using list_del() to remove entries from local->interfaces, while concurrent queue wake, stop, and disable paths walk the same list under Read-Copy-Update (RCU) synchronization. An asynchronous transmit completion in ieee802154_wake_queue() could follow a poisoned list node, causing a use-after-free. The fix changes list_del() to list_del_rcu() to properly defer the memory reclamation until in-flight RCU readers complete, followed by unregister_netdevice() which waits for the grace period before freeing the netdevice. This is a synchronization bug affecting Linux kernel versions back to at least 3.x.
Affected products
- Linux Linux kernel all versions prior to 2026-07-24 (approximately 3.x and later)
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-07-24: patched: Fix committed to stable Linux kernel trees
- 2026-07-01: other: Fix authored by Yousef Alhouseen