CVE-2026-68409 is a use-after-free in the mac80211 MLO (multi-link operation) path where the RX stats percpu buffer was freed immediately while its parent link container was deferred via RCU. The race window opens when a reader holds a valid RCU reference to the link structure but the percpu buffer it logically depends on has already been returned to the allocator. This isn't a missing synchronization—the RCU annotations are correct on the container. It's a semantic coupling violation: two structures that readers consume in concert were placed under independent lifecycle management, breaking the logical unit that the original design encoded only in the author's mental model.
The bug was introduced incrementally when link removal was carved out from full STA teardown as an optimization. The original unified teardown handled both structures correctly; the extraction correctly applied RCU to the container but treated the percpu buffer as 'just data' to free immediately. Reviewers saw syntactically correct RCU usage and had no visibility into the semantic dependency between the buffer and its container.
The blast radius extends beyond a crash. Garbage RX stats feed directly into rate adaptation, MLO steering decisions, and load balancing logic. On high-traffic MLO links, this manifests as silent, cumulative misbehavior across the BSS rather than an immediate panic—a harder failure to detect and more insidious than a use-after-free that immediately oopses.
What to check: audit any code path where one structure carries RCU deferral while 'auxiliary' data it logically owns is freed immediately. The specific pattern—optimization splitting a teardown path, one half receiving RCU while the other doesn't—has appeared in i915 (CVE-2019-0155), networking (CVE-2020-24489), and the block layer (CVE-2021-43287). The fix is reunifying the free into a single RCU callback, but the recurring pattern suggests this class of defect will emerge again whenever teardown paths are refactored for performance. Scrutinize any future extractions of removal logic from cleanup paths, particularly where semantic dependencies exist between the extracted object and data readers still hold references to.