CVE-2026-98331
Received Received - Intake

Use-after-free in Linux Kernel mac80211 Subsystem

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures. Then, mac80211 has an interface listed that doesn't exist, and will eventually hit BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211] cfg80211_unregister_wdev+0x15/0x1d [cfg80211] ieee80211_remove_interfaces+0x1ff/0x257 [mac80211] ieee80211_unregister_hw+0x73/0x1d1 [mac80211] mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim] Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98331
EUVD
EUVD-2026-93316

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 463d018323851a608eef52a9427b0585005c647f
Linux Linux 2.6.32

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac80211 subsystem where virtual interfaces (vifs) are not properly removed from a list when their network device (netdev) is unregistered. This can happen if the network namespace holding the wireless device is destroyed and the device fails to move to the init namespace due to allocation issues. The result is a dangling reference that can trigger a kernel bug and crash.

Impact Analysis

This vulnerability could cause system instability or crashes when network namespaces are destroyed or wireless interfaces are unregistered improperly. It may lead to kernel panics or unexpected behavior in systems using Wi-Fi, potentially disrupting network services or requiring a reboot to recover.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel logs for errors related to mac80211 or netdev unregistration to detect potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart