CVE-2026-74661— mac802154: fix netdev use-after-free in beacon worker
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： mac802154：修复 beacon 工作队列中的网络设备（netdev）释放后使用（use-after-free）问题 在 RCU 读锁保护下读取 ，并从中推导出子接口信息。然而，该函数随后释放了 RCU 读锁，但继续同时使用 和其中嵌入的 结构。 仅取消待处理的 beacon 工作、清空 并释放该请求。因此，一个正在运行的 beacon 工作可能在接口销毁之后继续执行，从而解引用已释放的网络设备私有数据区域，导致释放后使用漏洞。 扫描工作队列（scan worker）
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3accf4762734a69ebd03cba989249c78ac7dfc7e< fe820dcc1d8ff77783a9d2bcc93b98c99ac6d517 |
affected |
3accf4762734a69ebd03cba989249c78ac7dfc7e< e5fb0e03bc7f45508c182a427357bf6b389a9033 |
affected | ||
3accf4762734a69ebd03cba989249c78ac7dfc7e< e6cd416a899edc912b428c4ba399bd73f516cb31 |
affected | ||
3accf4762734a69ebd03cba989249c78ac7dfc7e< 9d067e581597c462c51fee8a30b51bc48a68c4e1 |
affected | ||
3accf4762734a69ebd03cba989249c78ac7dfc7e< 5f26a690e8efa54315e4922368daf54e0b8f5515 |
affected | ||
6.3 |
affected | ||
< 6.3 |
unaffected | ||
6.6.152≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74661
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mac802154: fix netdev use-after-free in beacon worker
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix netdev use-after-free in beacon worker
mac802154_beacon_worker() reads local->beacon_req under RCU and derives
the sub-interface from the request, but then drops the RCU read lock and
continues to use both sdata and the embedded wpan_dev.
mac802154_stop_beacons_locked() cancels only pending beacon work, clears
local->beacon_req and frees the request. A beacon worker that is already
running can therefore continue after interface teardown and dereference
the freed netdev private area.
The scan worker already pins the netdev before leaving RCU. Apply the
same lifetime rule to the beacon worker: take a netdev reference while
the request is still protected by RCU, and release it on all paths that
continue after the reference is acquired.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74661
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74661
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74661 (5)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-74661
No comments yet