Answer in brief
CVE-2026-23336 records a High severity (CVSS 7.8) vulnerability in wifi: cfg80211: cancel rfkill_block work in wiphy_unregister(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <82a35356b5c1f75fe6a8a561db44e8d0e49da8f9 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <b2e9626a9d16b9bbbd06498c9e73c93be354dc7a || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <eeea8da43ab86ac0a6b9cec225eec91564346940 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <fa18639deab4a3662d543200c5bfc29bf4e23173 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <57e39fe8da573435fa35975f414f4dc17d9f8449 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <584279ad9ff1e8e7c5494b9fce286201f7d1f9e2 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5 || >=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 <767d23ade706d5fa51c36168e92a9c5533c351a1 | 82a35356b5c1f75fe6a8a561db44e8d0e49da8f9, b2e9626a9d16b9bbbd06498c9e73c93be354dc7a, eeea8da43ab86ac0a6b9cec225eec91564346940, fa18639deab4a3662d543200c5bfc29bf4e23173, 57e39fe8da573435fa35975f414f4dc17d9f8449, 584279ad9ff1e8e7c5494b9fce286201f7d1f9e2, cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5, 767d23ade706d5fa51c36168e92a9c5533c351a1 |
| Linux/Linuxgeneric | 2.6.31 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Mar 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK> The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Quoted source text, attributed separately from HOL analysis.