Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: defer link RX stats percpu free to RCU
sta_remove_link() frees a removed MLO link's RX stats percpu buffer right
away, but defers only the link container to RCU:
sta_info_free_link(&alloc->info);
kfree_rcu(alloc, rcu_head);
The RX fast path reads link_sta under rcu_read_lock and writes the percpu
stats. A reader that resolved link_sta before the removal keeps the
pointer. The container stays alive from the kfree_rcu, so the read still
works. But the percpu block it points to is already freed. This needs
uses_rss. That is when pcpu_rx_stats exists.
The full STA teardown frees the deflink stats only after
synchronize_net(). The link removal path had no such barrier. The race is
hard to win in practice, but the free should still wait for RCU.
Free the link together with its data from a single RCU callback, so the
percpu block is reclaimed only after readers drain.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.0 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.6-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-38.38 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1014.14 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1017.17 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1016.16 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1008.9 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1015.15 | USN-8889-1, USN-8887-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1025.26 | USN-9043-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2022.23 | USN-9003-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1013.13 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-38.38.1 | USN-8887-1 |
| Ubuntu 24.04 LTS | linux +43 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 +1 | 7.0.0-1014.14~24.04.1 | USN-8887-3, USN-8887-2 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1017.17~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1016.16~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-38.38~24.04.4 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1024.25~24.04.1 | USN-9003-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1036.39 | USN-8886-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1013.13~24.04.1 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-38.38.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +42 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.53.1.el10_2 | RHSA-2026:65334 |
| RHEL 9 | rv +75 | 5.14.0-687.58.1.el9_8 | RHSA-2026:83156 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.173.1.rt7.514.el8_10 | RHSA-2026:82806 |
| RHEL 8 | perf +26 | 4.18.0-553.173.1.el8_10 | RHSA-2026:82807 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.53.1.el10_2 | ALSA-2026:65334 |
| AlmaLinux 9 | rv +73 | 5.14.0-687.58.1.el9_8 | ALSA-2026:83156 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.173.1.rt7.514.el8_10 | ALSA-2026:82806 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.173.1.el8_10 | ALSA-2026:82807 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.53.1.el10_2 | RLSA-2026:65334 |
| Rocky Linux 9 | kernel | 5.14.0-687.58.1.el9_8 | RLSA-2026:83156 |
| Rocky Linux 8 | kernel | 4.18.0-553.173.1.el8_10 | RLSA-2026:82807 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.173.1.rt7.514.el8_10 | RLSA-2026:82806 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.161.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | rv +28 | 5.14.0-687.58.1.el9_8 | ELSA-2026-83156 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.173.1.el8_10 | ELSA-2026-82807 |
Advisories 25
- USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8889-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9043-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8888-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8887-2 linux-aws-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- RHSA-2026:83156 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:82806 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:65334 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2730 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8886-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- ALSA-2026:83156 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65334 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:82807 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:82806 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:82807 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:83156 Important: kernel security update Rocky Linux Security Advisories · Oct 16, 2026
- RLSA-2026:82806 Important: kernel-rt security update Rocky Linux Security Advisories · Oct 15, 2026
- RLSA-2026:82807 Important: kernel security update Rocky Linux Security Advisories · Oct 15, 2026
- ELSA-2026-83156 Important: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- ELSA-2026-82807 Important: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 14, 2026
- RLSA-2026:65334 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 10, 2026
References
- https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92
- https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7
- https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f
- https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610
- https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b
- https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0