Cloudanix VulnDB

CVE-2026-98182

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration mistake in certain Linux wireless drivers can let someone with system rights crash the computer using ordinary network commands.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in ath_tx_node_init within the ath9k driver when mac80211 hands over a monitor interface created without a TXQ, triggered on interface bring-up after the monitor active flag is set on a down interface.

Why it matters to the business

Local denial of service on Linux systems using ath9k wireless hardware; an authenticated administrator can crash the kernel, causing system instability or requiring reboot, with low external exploit likelihood given the privilege requirement.

How an attack unfolds

An attacker possessing CAP_NET_ADMIN uses wireless configuration utilities to mark a down interface as monitor active, then brings the interface up; the mac80211 layer passes the interface to ath9k which immediately dereferences a missing queue pointer, producing a kernel oops.

How to fix it

Apply the upstream fix that refuses the monitor-active flag when the interface lacks a queue; rebuild and deploy the patched kernel image across affected distributions.

How to confirm the fix worked

Confirm the patched mac80211 code rejects the flag on queue-less interfaces; attempt the iw/ip sequence after upgrade and verify no oops occurs; inspect dmesg for absence of the ath_tx_node_init crash signature.

Typical attack path

  1. Obtain CAP_NET_ADMIN on the target host
  2. Execute iw dev <iface> set monitor active on a down interface
  3. Execute ip link set <iface> up
  4. Trigger ath_tx_node_init NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for the NULL pointer dereference BUG report followed by the ath_tx_node_init stack trace; correlate with preceding iw or ip link configuration events in audit or shell history.

  • BUG: kernel NULL pointer dereference, address: 0000000000000066
  • RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]
  • ath9k_add_interface+0x10c/0x140 [ath9k]
  • ieee80211_do_open+0x32f/0x800 [mac80211]

What your security team should do

  • Prioritize kernel updates on systems exposing ath9k hardware to untrusted local users
  • Restrict CAP_NET_ADMIN via SELinux, AppArmor, or sudo policies where monitor interface configuration is unnecessary
  • Monitor kernel logs for ath9k NULL dereference events until patching is complete

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver is handed a monitor with no queue. ath9k dereferences it: BUG: kernel NULL pointer dereference, address: 0000000000000066 RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k] ath9k_add_interface+0x10c/0x140 [ath9k] drv_add_interface+0x54/0x250 [mac80211] ieee80211_do_open+0x32f/0x800 [mac80211] Reached with CAP_NET_ADMIN by "iw dev X set monitor active" followed by "ip link set X up". RTNL is held, so netlink operations block behind it. Refuse the flag when there is no queue to give.

Affected packages

Ecosystem Package Introduced Fixed