Cloudanix VulnDB

CVE-2026-98331

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles wireless network interfaces during certain shutdown sequences can let local users crash the whole system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

mac80211 fails to remove virtual interfaces from the local->interfaces list when a netdev is unregistered outside the normal ieee80211_if_remove path, such as during netns destruction with allocation failures, leaving a dangling reference that triggers a BUG on wiphy_to_rdev during later cleanup.

Why it matters to the business

Local users or processes can trigger kernel crashes or memory corruption in wireless stack code, leading to denial of service, potential privilege escalation, and system instability on affected Linux systems handling Wi-Fi interfaces.

How an attack unfolds

An attacker with local access triggers netns destruction or interface unregistration paths that bypass normal removal, leaving a stale vif entry; subsequent wireless core operations dereference the invalid state, hitting the BUG and potentially allowing further memory manipulation.

How to fix it

Apply the upstream kernel patch that adds vif removal in the ndo_uninit handler when the interface is still listed; rebuild and deploy updated kernels containing the fix for mac80211 interface lifecycle handling.

How to confirm the fix worked

Confirm the patch is present by inspecting mac80211 source for the ndo_uninit unlist logic; test by destroying netns holding a wiphy and verifying no BUG or crash occurs during ieee80211_unregister_hw.

Typical attack path

  1. Obtain local access on a Linux system with mac80211 wireless interfaces
  2. Trigger netns destruction or wiphy move to init_ns that encounters allocation failure
  3. Cause netdev unregistration without ieee80211_if_remove
  4. Trigger ieee80211_remove_interfaces or cfg80211_unregister_wdev to hit the dangling list entry
  5. Exploit resulting invalid pointer dereference for crash or memory corruption

How to detect it

Review kernel logs for the wiphy_to_rdev BUG string or cfg80211/mac80211 stack traces during interface removal; inspect audit logs for netns or network namespace destruction events around crash times.

What your security team should do

  • Prioritize patching Linux kernels with wireless mac80211 support
  • Monitor for local wireless interface manipulation attempts
  • Restrict local user access on systems exposing Wi-Fi drivers until updated

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures. Then, mac80211 has an interface listed that doesn't exist, and will eventually hit BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211] cfg80211_unregister_wdev+0x15/0x1d [cfg80211] ieee80211_remove_interfaces+0x1ff/0x257 [mac80211] ieee80211_unregister_hw+0x73/0x1d1 [mac80211] mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim] Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.

Affected packages

Ecosystem Package Introduced Fixed