Linux: Improper Synchronization
CVE-2026-68404 is a high-severity improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 23517673b1eecaec95e61dde285220d5a980cf3f, c55590e4c69e0fd194df6d20bc35381c201d99e1, 4087a9ba4ece70297a4174afaa41c0b700302b65 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 23517673b1eecaec95e61dde285220d5a980cf3f or c55590e4c69e0fd194df6d20bc35381c201d99e1 or 4087a9ba4ece70297a4174afaa41c0b700302b65 or c2ddd180bbee766cf7359473d623423ea9485d93, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, 23517673b1eecaec95e61dde285220d5a980cf3f; bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, c55590e4c69e0fd194df6d20bc35381c201d99e1; bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, 4087a9ba4ece70297a4174afaa41c0b700302b65; bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, c2ddd180bbee766cf7359473d623423ea9485d93; bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, 6d6123fef5a4af175cc6b6b12a03dd0f3c240b79; bd2522b168847106c1885f0319a2833bdf88bf9a up to, but not including, 0c2ed186bbe14304415476d6707b747dddcd8583; 4.11 | 23517673b1eecaec95e61dde285220d5a980cf3f, c55590e4c69e0fd194df6d20bc35381c201d99e1, 4087a9ba4ece70297a4174afaa41c0b700302b65, c2ddd180bbee766cf7359473d623423ea9485d93, 6d6123fef5a4af175cc6b6b12a03dd0f3c240b79, 0c2ed186bbe14304415476d6707b747dddcd8583 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item. That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader. Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern. Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
How developers prevent this class of flaw
- Use industry standard APIs to synchronize your code.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
- git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583
- git.kernel.org/stable/c/23517673b1eecaec95e61dde285220d5a980cf3f
- git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65
- git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79
- git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93
- git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1
Recent Improper Synchronization vulnerabilities
- 8.4 High severity
- 7.1 High severity
- 7.8 High severity
- 7.5 High severity
- 8.8 High severity
- 8.2 High severity
Spotted an error? Tell us.