CVE-2026-68404

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: use wiphy work for socket owner autodisconnect

nl80211netlinknotify() walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnectwk work item.

That work is a plain workstruct today. NETDEVGOINGDOWN cancels it, but a NETLINKURELEASE notifier that already observed connownernlportid can queue it after that cancel returns. cfg80211unregisterwdev() then removes the wdev from the list and waits for RCU readers, but synchronizenet() does not drain work queued by such a reader.

Make the autodisconnect work a wiphywork instead. The callback already needs the wiphy mutex, and wiphywork runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancelworksync() vs. worker locking concern.

Also cancel the wiphy work after listdelrcu() and synchronizenet(). Any NETLINKURELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev.