CVE-2026-23336: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23336 is a use-after-free vulnerability in the Linux kernel's cfg80211 WiFi subsystem, specifically in the wiphy_unregister() function. The flaw occurs because the rfkill_block work queue is not cancelled during wireless physical device (wiphy) unregistration, allowing the work item to execute and access already-freed memory in cfg80211_shutdown_all_interfaces. It affects Linux kernel versions from 2.6.31 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using Syzkaller and disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). When a wireless device is unregistered via wiphy_unregister(), the associated rfkill_block work item is not cancelled before the wiphy structure's memory is freed. A kernel worker thread (kworker) can subsequently execute cfg80211_rfkill_block_work, which calls cfg80211_shutdown_all_interfaces and dereferences the now-freed wiphy memory, triggering a KASAN use-after-free report. The fix involves adding a cancel_work_sync() call for the rfkill_block work item within wiphy_unregister() to ensure the work completes or is cancelled before memory is released. The attack vector is local, requiring low privileges and no user interaction (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation by a local attacker with low privileges could result in a kernel crash (denial of service) or potentially privilege escalation, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is confined to systems with WiFi hardware managed by the cfg80211 subsystem and is triggered during WiFi device unregistration events. There is no evidence of lateral movement capability beyond the local system, but kernel-level compromise could allow an attacker to bypass security controls or access sensitive kernel memory (Red Hat CVE).

Apply the latest stable kernel patches for the affected branch. Fixed versions are: 5.10.253 (for 2.6.31.1–5.10.252), 5.15.203 (for 5.11–5.15.202), 6.1.167 (for 5.16–6.1.166), 6.6.130 (for 6.2–6.6.129), 6.12.77 (for 6.7–6.12.76), 6.18.17 (for 6.13–6.18.16), 6.19.7 (for 6.19–6.19.6), and 7.0-rc2 or later for the latest development branch. Patches are available via multiple stable kernel git commits. Debian, SUSE, and other distributions have issued corresponding security advisories and updated packages (Red Hat CVE, SUSE Advisory, Debian DSA-6238).

The vulnerability was reported by the Linux Verification Center using Syzkaller, a well-known kernel fuzzing tool, and has been acknowledged by Red Hat, Microsoft (for Azure Linux), Debian, and SUSE through their respective security advisories. Debian issued DSA-6238 and DSA-6243, and SUSE published SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1 addressing this and related kernel issues. No notable independent researcher commentary or significant social media discussion has been identified beyond standard distribution security channels (Debian DSA-6238, SUSE Advisory).