CVE-2026-68404

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: use wiphy work for socket owner autodisconnect

nl80211_netlink_notify() walks the cfg80211 wireless device list when a

NETLINK_GENERIC socket is released. If the socket owns a connection, the

notifier queues the embedded wdev->disconnect_wk work item.

That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a

NETLINK_URELEASE notifier that already observed conn_owner_nlportid can

queue it after that cancel returns. _cfg80211_unregister_wdev() then

removes the wdev from the list and waits for RCU readers, but

synchronize_net() does not drain work queued by such a reader.

Make the autodisconnect work a wiphy_work instead. The callback already

needs the wiphy mutex, and wiphy_work runs under that mutex. This lets

teardown cancel pending autodisconnect work while holding the mutex,

without a cancel_work_sync() vs. worker locking concern.

Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any

NETLINK_URELEASE notifier that had already reached the wdev list has then

either queued the work and it is removed, or can no longer find the wdev.