CVE-2026-98311
Received Received - Intake

wifi: virt_wifi Use-After-Free in Link State Handling

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: don't transfer operstate before register virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry. Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98311
EUVD
EUVD-2026-93296

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux c7cdba31ed8b87526db978976392802d3f93110c
Linux Linux 5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's virt_wifi driver. It occurs when virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(), causing a netdev to be queued on lweventlist while still uninitialized. If registration fails later, free_netdev() frees the object, but a subsequent linkwatch_fire_event() can still access the freed memory.

Detection Guidance

This vulnerability affects the Linux kernel's virt_wifi driver and involves improper state transfer before device registration. Detection requires checking for uninitialized netdev structures or failed registrations in the virt_wifi module. Monitor kernel logs for errors related to netdev registration or use-after-free events in the wifi subsystem.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition. It affects systems using the virt_wifi driver in the Linux kernel.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid using virt_wifi or disable the module temporarily. Monitor kernel logs for related errors and update network drivers to ensure proper initialization sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart