CVE-2026-68405: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

ieee80211_do_stop() removes AP_VLAN packets from the parent AP
ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then
calls ieee80211_free_txskb() before dropping the lock.

ieee80211_free_txskb() is not just a passive SKB release. For SKBs with
TX status state it can report a dropped frame through cfg80211/nl80211,
and that path can reach netlink tap transmit. This is the same reason
the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs
under the queue lock and frees them after IRQ state is restored.

The buggy scenario involves two paths, with each column showing the
order within that path:

AP_VLAN management TX:             AP_VLAN stop:
1. attach ACK-status state         1. clear the running state
2. queue a multicast SKB on        2. take ps->bc_buf.lock with IRQs
   parent ps->bc_buf                  disabled
                                   3. unlink the AP_VLAN SKB
                                   4. call ieee80211_free_txskb()

Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock,
but move them to a local free queue. Drop the lock and restore IRQ state
before calling ieee80211_free_txskb().

WARNING: kernel/softirq.c:430 at __local_bh_enable_ip

The Linux kernel CVE team has assigned CVE-2026-68405 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.9 with commit 397a7a24ef8c2967a3e8090013f9c54714110c48 and fixed in 6.6.148 with commit be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef
	Issue introduced in 3.9 with commit 397a7a24ef8c2967a3e8090013f9c54714110c48 and fixed in 6.12.101 with commit 962f755a47d7ec3bbf6c709697d7f4c5f798441d
	Issue introduced in 3.9 with commit 397a7a24ef8c2967a3e8090013f9c54714110c48 and fixed in 6.18.42 with commit a424985c3ef2a87ce6057a853e18d0c441a86be8
	Issue introduced in 3.9 with commit 397a7a24ef8c2967a3e8090013f9c54714110c48 and fixed in 7.1.6 with commit 4b8abf43bf34791c99d99dc3be13f897adefc461
	Issue introduced in 3.9 with commit 397a7a24ef8c2967a3e8090013f9c54714110c48 and fixed in 7.2-rc4 with commit f3858d5b1432098c1936e03d6e03dd0e33facf60

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68405
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mac80211/iface.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef
	https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d
	https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8
	https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461
	https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60