CVE-2026-68408: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68408 is a deadlock vulnerability in the Linux kernel's cfg80211 (wireless configuration) subsystem affecting PMSR (Peer Measurement Service Request) handling. When a netlink socket owning a PMSR session is closed concurrently with an interface teardown, a circular lock dependency between wiphy_lock and cancel_work_sync() causes kernel execution to freeze in the wireless subsystem. The vulnerability was published on August 10, 2026, and affects Linux kernel versions in the ranges 6.1.167–6.2, 6.6.130–6.7, 6.12.78–6.12.101, 6.18.20–6.18.42, and 6.19.10–6.20, among specific git commit ranges. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a classic deadlock (CWE-833) in the Linux kernel's cfg80211 PMSR work queue handling. When cfg80211_release_pmsr() queues pmsr_free_wk asynchronously and cfg80211_pmsr_wdev_down() is simultaneously called under wiphy_lock, the latter invokes cancel_work_sync(&pmsr_free_wk) to wait for the work item to complete. However, the work function itself attempts to acquire wiphy_lock via guard(wiphy), creating a circular wait: wdev_down holds wiphy_lock while blocking in cancel_work_sync(), and pmsr_free_wk blocks trying to acquire that same lock. The same deadlock path is reachable from cfg80211_leave_locked(), which calls cfg80211_pmsr_wdev_down() for all interface types while holding wiphy_lock. The fix converts pmsr_free_wk from a plain work_struct to a wiphy_work, allowing wiphy_work_cancel() to be called safely while holding wiphy_lock without blocking (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel deadlock that freezes execution in the cfg80211 wireless configuration subsystem, resulting in a denial of service. Any local user with the ability to create and close PMSR sessions or trigger concurrent interface teardown can induce this condition, disabling wireless interface operations on the affected system. There is no confidentiality or integrity impact; the vulnerability is limited to availability (kernel freeze/hang) (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit exists, and there is no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges (a standard user account capable of managing PMSR sessions or triggering interface teardown). The EPSS score is approximately 0.168% (6th percentile), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Red Hat Bugzilla).

Apply the upstream kernel patch that converts pmsr_free_wk from a plain work_struct to a wiphy_work, which eliminates the deadlock by ensuring wiphy_work_cancel() never blocks while wiphy_lock is held. Fixed kernel versions include 6.12.101+ (for the 6.12.x branch), 6.18.42+ (for the 6.18.x branch), 7.1.6+ (for the 7.1.x branch), and 7.2 or later. Specific stable-tree fix commits are available at the kernel.org stable repository. Users on affected distributions should apply vendor-provided kernel updates as they become available (Github Advisory, Red Hat Bugzilla).