CVE-2026-98330 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: get the wiphy out of a dying network namespace
When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fail (due to allocation failures), and then the wiphy is left behind with a garbage netns pointer:
Kernel mode fault at addr 0x30 genlmsg_multicast_netns.constprop.0+0x46/0xcf [cfg80211]
nl80211_notify_wiphy+0xcd/0xe8 [cfg80211]
wiphy_unregister+0x169/0x3fc [cfg80211]
Note that commit debac3a20dec ("net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().") fixed another path that could reach it without allocation failures.
Remove interfaces that cannot be moved instead of failing the switch, so that the wiphy always ends up in the initial namespace. In this case the netdev core will unregister the interfaces anyway.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel vulnerability identified involves a critical flaw within the wireless configuration subsystem, specifically affecting how network interface physical devices known as phy or wiphys are handled during the destruction of network namespaces. This issue arises when a user-space application destroys a non-initial network namespace that contains registered wireless interfaces. During this cleanup process, the cfg80211_pernet_exit function attempts to migrate all associated wiphy structures from the dying namespace back to the initial or default network namespace. The original implementation relied on moving these interfaces and issued only a warning if such migration failed due to resource constraints like memory allocation failures. However, when an interface cannot be moved because of these allocation errors, the code path left the wiphy structure with a dangling pointer referencing the now-destroyed network namespace rather than safely relocating it or nullifying its reference.
This improper handling leads directly to use-after-free conditions and kernel mode faults as evidenced by crash traces showing failures in genlmsg_multicast_netns and nl80211_notify_wiphy functions called during wiphy unregister operations. The root cause lies in the assumption that moving an interface is always possible or that failure merely requires a warning rather than corrective action. When allocation fails, the pointer remains valid enough to be dereferenced later but points to freed memory associated with the deleted namespace context. This creates a classic use-after-free scenario where subsequent kernel operations attempt to access network namespace data structures that no longer exist in physical memory, resulting in unpredictable behavior including system crashes or potential privilege escalation if an attacker can control timing and allocation patterns.
From a security architecture perspective, this vulnerability maps closely to CWE-416 which describes Use After Free vulnerabilities. The flaw occurs because the kernel retains references to objects whose underlying resources have been deallocated during namespace teardown procedures. In terms of attack vectors, this aligns with ATT&CK technique T1059 Command and Scripting Interpreter through indirect means since exploitation typically requires triggering specific network configuration changes that force allocation failures at precise moments during namespace destruction. An attacker might exploit race conditions or resource exhaustion techniques to induce the failure condition necessary for dereferencing invalid pointers. The impact ranges from denial of service via kernel panic to potential information disclosure if adjacent memory contents are leaked through improper pointer access patterns before system crash occurs.
The resolution implemented in this patch addresses the issue by changing the behavior when interface migration fails. Instead of leaving the wiphy with a garbage netns pointer and merely issuing warnings, the updated code removes interfaces that cannot be moved from their current namespace context entirely. This ensures that every wiphy ultimately ends up safely within the initial network namespace where it can be properly managed without referencing invalid memory regions. The network device core handles unregistration of these removed interfaces automatically, maintaining consistency in object lifecycle management. This approach eliminates the dangling pointer scenario by ensuring no references persist to destroyed namespace structures while preserving system stability during complex networking operations involving multiple virtualized network environments.
Mitigation strategies for organizations running affected Linux kernel versions include applying vendor-provided security patches that incorporate this fix immediately upon availability. System administrators should monitor syslog and dmesg outputs for warnings related to cfg80211_pernet_exit failures which may indicate attempted exploitation or resource pressure conditions preceding potential crashes. Implementing strict memory allocation monitoring can help detect unusual patterns that might trigger the failure condition exploited by attackers. Additionally, limiting unprivileged users' ability to create and destroy network namespaces reduces the attack surface for triggering this vulnerability in multi-tenant environments such as containerized deployments where namespace isolation is frequently utilized. Regular kernel updates remain essential since similar issues may exist across other subsystems handling resource migration during lifecycle transitions.