CVE-2026-97595

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix use-after-free of sdata via queued RX frames

The RX softirq producer ieee802154_subif_frame() queues received beacon

and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and

schedules a process-context worker, storing a raw mac_pkt->sdata (and

skb->dev == sdata->dev) with neither a reference nor any locking:

- the lists have no lock: the softirq producer list_add_tail()s while the

mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt

the list;

- the workers dereference the interface after it may have been freed.

mac802154_rx_mac_cmd_worker() touches mac_pkt->sdata directly, and

mac802154_rx_beacon_worker() -> mac802154_process_beacon() dereferences

skb->dev (== sdata->dev). Removing an interface frees its sdata

(netdev_priv) while a queued frame still points at it, so a later worker

run is a use-after-free.

Reproduced under KASAN by flooding a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References