CVE-2026-98311

What it actually does

Use-after-free in the Linux kernel virt_wifi driver caused by calling netif_stacked_transfer_operstate before register_netdevice, allowing a freed netdev list entry to be accessed later via linkwatch_fire_event when registration fails.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or memory corruption leading to denial of service or potential privilege escalation, impacting system availability and security posture on wireless virtualization setups.

How an attack unfolds

An attacker with local access creates a virt_wifi interface using an invalid name such as one containing a slash, causing netif_stacked_transfer_operstate to queue the uninitialized device; subsequent registration failure frees the object while linkwatch later dereferences the stale list entry, resulting in use-after-free.

How to fix it

Apply the upstream kernel patch that moves netif_stacked_transfer_operstate after netdev_upper_dev_link in virt_wifi_newlink; rebuild and deploy updated kernels containing the fix for all affected distributions.

How to confirm the fix worked

Inspect kernel source for virt_wifi_newlink to confirm netif_stacked_transfer_operstate is called after netdev_upper_dev_link; verify running kernel version includes the resolution commit and test interface creation with invalid names does not panic.

Typical attack path

1. Obtain local user access on a Linux system with virt_wifi enabled
2. Invoke netlink or ioctl to create a virt_wifi interface with an invalid device name
3. Trigger registration failure path after the premature operstate transfer
4. Force linkwatch event processing to access the freed object

How to detect it

Review kernel logs for use-after-free warnings or panics involving linkwatch, lweventlist, or virt_wifi_newlink; correlate with audit logs showing netlink interface creation attempts with malformed names.

What your security team should do

• Prioritize kernel updates on all systems exposing virt_wifi or wireless virtualization
• Restrict unprivileged local users from creating network interfaces via policy or namespaces until patched
• Monitor for kernel oops or panic logs related to netdevice list handling
• Review and limit use of virt_wifi in production environments