CVE-2026-98182 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: refuse to make a monitor active when it has no queue
A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver is handed a monitor with no queue. ath9k dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000066 RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]
ath9k_add_interface+0x10c/0x140 [ath9k]
drv_add_interface+0x54/0x250 [mac80211]
ieee80211_do_open+0x32f/0x800 [mac80211]
Reached with CAP_NET_ADMIN by "iw dev X set monitor active" followed by "ip link set X up". RTNL is held, so netlink operations block behind it.
Refuse the flag when there is no queue to give.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel vulnerability identified in the mac80211 subsystem involves a critical NULL pointer dereference within the ath9k wireless driver, triggered by improper handling of monitor interface states during initialization. This flaw arises from an inconsistency between the mac80211 virtual interface management logic and the specific requirements of certain hardware drivers like ath9k. Specifically, when a user attempts to configure a network interface as a monitor type with active transmission capabilities using netlink operations such as iw dev X set monitor active followed by ip link set X up, the kernel fails to ensure that a transmit queue (TXQ) is allocated before passing control to the driver layer. The mac80211 subsystem only assigns a TXQ to a monitor interface if it is created in an active state from inception; however, setting the active flag on an already existing down interface does not trigger this allocation logic. Consequently, the ath9k driver receives a reference to a monitor interface that lacks the necessary transmission queue structure required for normal operation.
The technical root cause lies in the sequence of operations performed during interface activation. When the netlink command sets the monitor active flag on an interface that is currently down, the mac80211 layer allows this state change but does not immediately allocate or attach a TXQ because the interface is not yet up. Subsequently, when the ip link set X up command is executed to bring the interface online, the driver initialization routine ath9k_add_interface is invoked. This function calls ath_tx_node_init, which attempts to access members of the transmit queue structure without verifying its existence or validity. Since no TXQ was allocated during the earlier flag-setting phase due to the down state of the interface, this pointer remains NULL. The subsequent dereference results in a kernel panic characterized by a BUG: kernel NULL pointer dereference at address 0x66 within ath_tx_node_init, effectively crashing the system or causing severe instability depending on the context and error handling mechanisms present in the broader kernel environment.
From an operational impact perspective, this vulnerability allows for local denial of service attacks against systems running affected Linux kernels with ath9k wireless hardware enabled. An attacker possessing CAP_NET_ADMIN privileges can exploit this race condition-like behavior by crafting specific netlink messages to manipulate interface states rapidly or sequentially as described. The exploitation requires the RTNL lock to be held, which ensures that netlink operations block behind it, but does not prevent the flawed logic from executing during the state transition phase. While remote code execution is unlikely given the nature of a NULL pointer dereference leading to an oops or panic rather than arbitrary memory write, the availability impact is severe as it can crash the kernel, disrupt network connectivity for all users on the system, and potentially lead to data loss if unsaved work is present in affected processes. The requirement for CAP_NET_ADMIN limits the attack surface primarily to local attackers with administrative privileges or those who have compromised a service running under such credentials.
To mitigate this vulnerability, it is essential to enforce strict validation checks within the mac80211 subsystem before allowing state transitions that depend on hardware-specific resources like transmit queues. The fix involves refusing to set the monitor active flag if there is no corresponding queue available for allocation at that time. This ensures that drivers are never handed a malformed interface structure lacking required data structures. Administrators should apply kernel updates provided by their distribution vendors which include this patch, ensuring that the mac80211 layer correctly validates resource availability before permitting configuration changes that rely on them. Additionally, defensive programming practices within driver code such as ath9k can be reinforced to check for NULL pointers before dereferencing critical structures, although the primary responsibility lies with the virtual interface management logic in mac80211 to maintain consistency between state flags and allocated resources.
This vulnerability aligns with CWE-476, which describes a NULL pointer dereference error where software incorrectly handles a null reference instead of properly checking for it before use. In terms of attack vector classification under the MITRE ATT&CK framework, this falls under T1059 Command and Scripting Interpreter via netlink sockets, specifically leveraging administrative privileges to manipulate system configuration in a way that leads to resource exhaustion or crash conditions. The exploitation path highlights the importance of validating state transitions in network stack components, particularly when interacting with hardware drivers that have strict assumptions about interface initialization sequences. Proper implementation of these checks prevents the driver from entering an invalid operational state and maintains kernel stability during dynamic network configuration changes.