{"id":"CVE-2026-68408","summary":"wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock\n\nWhen a netlink socket that owns a PMSR session is closed,\ncfg80211_release_pmsr() clears the request's nl_portid and queues\npmsr_free_wk to call cfg80211_pmsr_process_abort() asynchronously.\n\nIf the interface tears down concurrently, cfg80211_pmsr_wdev_down()\nis called under wiphy_lock and calls cancel_work_sync(&pmsr_free_wk)\nto wait for any running work. The work function acquires wiphy_lock\nvia guard(wiphy) before calling process_abort.\n\nThis is a deadlock: wdev_down holds wiphy_lock and blocks inside\ncancel_work_sync(); pmsr_free_wk blocks trying to acquire that same\nwiphy_lock. Neither thread can proceed.\n\nThe same deadlock is reachable from cfg80211_leave_locked(), which\ncalls cfg80211_pmsr_wdev_down() for all interface types under\nwiphy_lock.\n\nFix this by converting pmsr_free_wk from a plain work_struct to a\nwiphy_work. The wiphy_work dispatcher holds wiphy_lock when running\nwork items, so the explicit guard(wiphy) in the work function is no\nlonger needed. wiphy_work_cancel() can be called safely while holding\nwiphy_lock - since wiphy_lock prevents the work from running\nconcurrently, wiphy_work_cancel() never blocks, eliminating the\ndeadlock.\n\nRemove the cancel_work_sync() for pmsr_free_wk from the\nNETDEV_GOING_DOWN handler. cfg80211_leave(), called unconditionally\njust before it, already cancels any pending work under wiphy_lock\nvia wiphy_work_cancel() inside cfg80211_pmsr_wdev_down().","modified":"2026-11-01T02:30:45.360712141Z","published":"2026-08-10T12:04:28.172Z","related":["SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","openSUSE-SU-2026:21910-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68408.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0a77d9fb4d5c0e01306cd406ffdee8f1fe955c0e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/133684982dd0c24359fcc641d19d89cc17d6e5ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/21512b5f7a74fd18c996c22e6854efe57d570816"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2b0eab425e1f658d8fe1df7590e3b9af5959505e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/30c67926d41c456809857976cd3cd71b2290e0c1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/efe47df4de5e3e19b0670c5f2f67bdc4c9dc02af"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68408.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68408"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"28d3551f8d8cb3aec7497894d94150fe84d20e5e"},{"fixed":"efe47df4de5e3e19b0670c5f2f67bdc4c9dc02af"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"37e776e2e0a523731e2470dce6d563f0e8632a40"},{"fixed":"30c67926d41c456809857976cd3cd71b2290e0c1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa"},{"fixed":"21512b5f7a74fd18c996c22e6854efe57d570816"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf"},{"fixed":"133684982dd0c24359fcc641d19d89cc17d6e5ef"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09"},{"fixed":"0a77d9fb4d5c0e01306cd406ffdee8f1fe955c0e"},{"fixed":"2b0eab425e1f658d8fe1df7590e3b9af5959505e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.167"},{"fixed":"6.1.191"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.130"},{"fixed":"6.6.160"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.78"},{"fixed":"6.12.101"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.20"},{"fixed":"6.18.42"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.19.10"},{"fixed":"6.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"72b7ea786b8e570ae11149e9089859a4a8634a13"}]}],"versions":["v6.1.190","v6.1.189","v6.1.188","v6.1.187","v6.1.186","v6.1.185","v6.1.184","v6.1.183","v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.1.177","v6.1.176","v6.1.175","v6.1.174","v6.1.173","v6.1.172","v6.1.171","v6.1.170","v6.1.169","v6.1.168","v6.1.167","v6.6.159","v6.6.158","v6.6.157","v6.6.156","v6.6.155","v6.6.154","v6.6.153","v6.6.152","v6.6.151","v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.18.41","v6.18.40","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.18.23","v6.18.22","v6.18.21","v6.18.20","v6.19.14","v6.19.13","v6.19.12","v6.19.11","v6.19.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68408.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68408.json"}}],"schema_version":"1.9.2"}