CVE-2026-72024
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, in the mac802154 subsystem, interface removal does not use RCU, which can lead to use-after-free during asynchronous transmit completion. The fix changes list_del() to list_del_rcu() to ensure safe removal in RCU context.
Risk Assessment
Risk of system crash or undefined behavior in concurrent access to 802.15.4 network interfaces.
Recommendation
It is recommended to update the Linux kernel to a patched version and avoid dynamic interface management in high-concurrency environments.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local->interfaces under RCU. The bulk hardware teardown path removes entries with list_del(), so an asynchronous transmit completion can follow a poisoned list node in ieee802154_wake_queue(). Use list_del_rcu() as in the single-interface removal path. The following unregister_netdevice() waits for in-flight RCU readers before freeing the netdevice, so no separate grace-period wait is needed.