Cloudanix VulnDB

CVE-2026-98346

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux Wi-Fi code can make the system crash when handling certain wireless devices, briefly taking network connections offline.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference crash in cfg80211_calculate_bi_data when rdev_get_radio_mask is called with a wdev whose netdev pointer is NULL, propagating into mac80211.

Why it matters to the business

Wireless networking on affected Linux systems can become unavailable, interrupting connectivity-dependent operations and requiring system restarts or reboots to recover.

How an attack unfolds

An attacker or local process creates or manipulates wireless interfaces to produce netdev-less wdev objects, then triggers beaconing or related cfg80211 operations that reach the vulnerable calculation path, resulting in a kernel crash.

How to fix it

Apply the upstream kernel fix that inverts the order of checks so that netdev validity is confirmed before calling rdev_get_radio_mask; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains the reordered checks; reproduce netdev-less wdev scenarios in a test environment and verify absence of crashes.

Typical attack path

  1. Create or obtain a wdev without an associated netdev
  2. Invoke cfg80211 operations that call calculate_bi_data
  3. Pass the wdev to rdev_get_radio_mask causing NULL dereference
  4. Crash the kernel in mac80211

How to detect it

Review kernel logs and dmesg for oops or panic entries referencing cfg80211_calculate_bi_data or rdev_get_radio_mask around the time of wireless interface activity.

  • cfg80211_calculate_bi_data
  • rdev_get_radio_mask
  • wdev->netdev NULL
  • mac80211 radio mask crash

What your security team should do

  • Prioritize kernel updates once fixed versions are released
  • Monitor kernel logs for cfg80211-related oops or panics
  • Restrict unprivileged access to wireless interface configuration where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since wdev->netdev is always valid for beaconing interfaces.

Affected packages

Ecosystem Package Introduced Fixed