Cloudanix VulnDB

CVE-2026-98326

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux wireless mesh networking could leave systems in a bad state during network setup failures, leading to errors or instability.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to release an acquired channel context when ieee80211_start_mesh fails leaves the interface in an inconsistent state, causing warnings and improper unassignment attempts during later teardown in mac80211 mesh handling.

Why it matters to the business

Linux systems using wireless mesh networking may experience log spam, interface instability, or crashes during network setup or removal, reducing reliability of affected devices and complicating operations.

How an attack unfolds

An attacker with local access could attempt to trigger repeated mesh join failures to induce the channel leak and subsequent teardown warnings, but the issue is a stability bug with no evidence of remote exploitation or use by threat actors.

How to fix it

Apply the upstream kernel patch that ensures channel context release on mesh start failure; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm absence of the drv_unassign_vif_chanctx warning and check-sdata-in-driver messages in kernel logs during mesh join failures and interface removal after patching.

Typical attack path

  1. Obtain local access to trigger ieee80211_join_mesh
  2. Cause ieee80211_start_mesh to fail after channel acquisition
  3. Trigger interface removal to hit the unassign path and warnings

How to detect it

Search kernel logs and dmesg for strings referencing wlan0 failed check-sdata-in-driver, drv_unassign_vif_chanctx, or ieee80211_link_release_channel during mesh or interface operations.

What your security team should do

  • Prioritize kernel updates on systems using mac80211 mesh
  • Monitor wireless interface teardown logs for the described warnings
  • Test mesh configuration changes in staging before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211_join_mesh() acquires a channel context and then calls ieee80211_start_mesh(), which can fail. In that case, the chanctx isn't released then interface removal will attempt to unassign it after it's removed from the driver, hitting: wlan0: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx ieee80211_assign_link_chanctx __ieee80211_link_release_channel ieee80211_link_release_channel ieee80211_teardown_sdata unregister_netdevice_many_notify _cfg80211_unregister_wdev ieee80211_remove_interfaces ieee80211_unregister_hw mac80211_hwsim_del_radio hwsim_exit_net Correctly release the channel on start failures.

Affected packages

Ecosystem Package Introduced Fixed