{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-97595",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-97595",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-25T10:22:11.134Z",
    "updatedAt": "2026-10-19T09:09:59.016Z",
    "importedAt": "2026-10-24T01:58:41.756Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "mac802154: fix use-after-free of sdata via queued RX frames",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix use-after-free of sdata via queued RX frames\n\nThe RX softirq producer ieee802154_subif_frame() queues received beacon\nand MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and\nschedules a process-context worker, storing a raw mac_pkt->sdata (and\nskb->dev == sdata->dev) with neither a reference nor any locking:\n\n - the lists have no lock: the softirq producer list_add_tail()s while the\n   mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt\n   the list;\n\n - the workers dereference the interface after it may have been freed.\n   mac802154_rx_mac_cmd_worker() touches mac_pkt->sdata directly, and\n   mac802154_rx_beacon_worker() -> mac802154_process_beacon() dereferences\n   skb->dev (== sdata->dev). Removing an interface frees its sdata\n   (netdev_priv) while a queued frame still points at it, so a later worker\n   run is a use-after-free.\n\nReproduced under KASAN by flooding a victim interface with MAC command\nframes and removing it (the beacon path is the same class via skb->dev):\n\n  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n  Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31\n  Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]\n  Call Trace:\n   mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n   process_one_work+0x611/0xe80\n   worker_thread+0x52e/0xdc0\n   kthread+0x30c/0x630\n   ret_from_fork+0x2fd/0x3e0\n\nFix both lists together:\n\n - add local->rx_lock and take it around every list access: the softirq\n   producer (plain spin_lock, softirq context) and the workers and flush\n   (spin_lock_bh, process context);\n\n - pin the interface for the lifetime of a queued frame with\n   netdev_hold()/netdev_put(), so the worker can safely dereference sdata /\n   skb->dev even while the interface is being removed;\n\n - dequeue under the lock at the head and loop-drain the whole list in the\n   workers (they previously processed one frame per run and relied on a\n   later enqueue to drain the rest);\n\n - drop not-yet-started frames of an interface before it is unregistered,\n   from ieee802154_if_remove() (after the RCU grace period) and from the\n   ieee802154_remove_interfaces() loop -- the latter is the whole-phy\n   teardown path, which does not go through ieee802154_if_remove().\n\nAn in-flight worker that already dequeued a frame keeps its own netdev\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has\nbeen closed, so it does not pin rtnl. A worker blocked in an association\nTX only delays that one interface's unregister (the usual \"waiting for %s\nto become free\"), it does not hold rtnl. netdev_hold() is used for this\nreason instead of a cancel_work_sync() under rtnl, which would block on\nthe worker's unbounded MLME TX wait via ieee802154_sync_queue().\n\nThe mac-command worker additionally skips processing for a stopped\ninterface (ieee802154_sdata_running()), avoiding a needless association\nresponse during teardown.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4826fd8373f684f9952536333ad45b26acd3455d"
            },
            {
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4740ef0518c5e3bf31ebfb2288a6ac3b462ead06"
            },
            {
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "status": "affected",
              "versionType": "git",
              "lessThan": "07f0214018d7241e3610c1be984c8abfce16c099"
            },
            {
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc"
            },
            {
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2f37fba846c9fdff5fc15b6d93656057ccd13031"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.3",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.3"
            },
            {
              "version": "6.6.158",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.111",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.53",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.7",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}