Cloudanix VulnDB

CVE-2026-98330

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's wireless code can let someone who already has access to the computer crash the whole system or potentially take it over.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel cfg80211 subsystem triggered when wiphy migration from a dying network namespace fails due to allocation errors, leaving a dangling netns pointer that is later dereferenced during wiphy_unregister or nl80211_notify_wiphy, resulting in invalid memory access.

Why it matters to the business

Linux systems using wireless networking face risk of kernel crashes or local privilege escalation, causing unplanned downtime, data loss, and potential full system compromise on servers, desktops, or embedded devices.

How an attack unfolds

An attacker with local access repeatedly creates and destroys network namespaces while inducing allocation pressure to force move failures, leaving a garbage netns pointer; subsequent wiphy operations then dereference the invalid pointer, producing a fault that can be turned into arbitrary code execution or denial of service.

How to fix it

Upgrade to a Linux kernel containing the fix that removes interfaces which cannot be moved instead of failing the namespace switch, ensuring the wiphy always lands in the initial namespace.

How to confirm the fix worked

Confirm the running kernel includes the resolution for the netns exit path in cfg80211_pernet_exit; test by destroying namespaces under allocation stress and verifying no kernel faults occur in genlmsg_multicast_netns or wiphy_unregister.

Typical attack path

  1. Obtain local user access on a Linux host
  2. Create and destroy network namespaces under memory pressure to trigger allocation failure during wiphy move
  3. Force wiphy unregistration to dereference the dangling pointer
  4. Leverage the resulting use-after-free for kernel code execution or crash

How to detect it

Review kernel logs and dmesg output for faults referencing cfg80211 functions such as genlmsg_multicast_netns, nl80211_notify_wiphy, or wiphy_unregister occurring during network namespace teardown.

What your security team should do

  • Prioritize kernel updates on all wireless-enabled Linux systems
  • Limit untrusted local accounts and namespace creation privileges
  • Enable kernel hardening features such as KASAN or memory tagging where available
  • Monitor for related kernel oops entries in production logs

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fail (due to allocation failures), and then the wiphy is left behind with a garbage netns pointer: Kernel mode fault at addr 0x30 genlmsg_multicast_netns.constprop.0+0x46/0xcf [cfg80211] nl80211_notify_wiphy+0xcd/0xe8 [cfg80211] wiphy_unregister+0x169/0x3fc [cfg80211] Note that commit debac3a20dec ("net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().") fixed another path that could reach it without allocation failures. Remove interfaces that cannot be moved instead of failing the switch, so that the wiphy always ends up in the initial namespace. In this case the netdev core will unregister the interfaces anyway.

Affected packages

Ecosystem Package Introduced Fixed