CVE-2026-98331 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: unlist vifs when their netdev is unregistered
mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures.
Then, mac80211 has an interface listed that doesn't exist, and will eventually hit
BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211]
cfg80211_unregister_wdev+0x15/0x1d [cfg80211]
ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]
ieee80211_unregister_hw+0x73/0x1d1 [mac80211]
mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]
Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified involves a race condition and state inconsistency within the mac80211 wireless subsystem, specifically concerning the lifecycle management of virtual interfaces (vifs) associated with network namespaces. The core issue stems from an asymmetry in how interface removal is handled during normal operations versus system teardown scenarios involving network namespace destruction. Under standard conditions, when a wireless interface is removed via ieee80211_if_remove(), the mac80211 subsystem correctly removes the virtual interfaces from the local->interfaces list before unregistering the underlying netdev device. This ensures that internal data structures remain synchronized with the actual state of network devices in the system. However, this safety mechanism fails when a network namespace containing a wireless physical layer (wiphy) is destroyed and attempts to migrate its wiphies to the initial network namespace due to allocation failures or other constraints during the migration process.
In such scenarios where netdev unregistration occurs without traversing the standard ieee80211_if_remove() path, mac80211 retains references to virtual interfaces that no longer have valid backing netdev structures. This creates a dangling pointer situation within the kernel's internal data structures. As subsequent cleanup routines attempt to iterate over or manipulate these stale interface entries, they encounter invalid memory states. The specific failure manifests as a BUG check triggered in core.h at the wiphy_to_rdev() macro invocation. This occurs because the code attempts to dereference a virtual device structure that has already been freed or invalidated during the netdev unregistration process but was not properly removed from mac80211's tracking list. The resulting kernel panic halts system operation, leading to a denial of service for any processes relying on wireless connectivity or those interacting with the affected network namespace.
From a technical classification perspective, this vulnerability aligns with CWE-416: Use After Free, as the kernel continues to operate on references to objects that have been logically removed from their expected lifecycle state but not physically cleaned up in all tracking structures. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, given that the race condition arises during complex teardown sequences involving namespace migrations and allocation failures where timing is critical. In terms of MITRE ATT&CK mapping for Linux systems, this could be categorized under T1059: Command and Scripting Interpreter if exploited to cause a crash in a containerized environment, or more broadly as part of resource exhaustion techniques leading to system instability. The vulnerability primarily impacts availability rather than confidentiality or integrity directly, although the resulting kernel panic can compromise overall system stability.
The operational impact includes potential denial of service for wireless services running within affected network namespaces. In virtualization and cloud environments where dynamic creation and destruction of network namespaces are common practices for container isolation, this flaw could be triggered by malicious actors creating numerous namespace cycles to exhaust resources or trigger allocation failures intentionally. This would result in kernel panics across host nodes if the vulnerability is reachable from unprivileged contexts that can manipulate network interfaces within their assigned namespaces. Mitigation strategies involve applying vendor-provided kernel patches that address the mac80211 interface list management logic. The fix ensures that virtual interfaces are explicitly removed from the local->interfaces list in the ndo_uninit callback if they remain present, thereby guaranteeing cleanup regardless of whether standard removal paths were followed. Administrators should ensure their systems run patched kernels and monitor for any unusual crashes related to wireless subsystem initialization or teardown processes. Regular auditing of network namespace lifecycles and ensuring adequate memory allocation resources can further reduce the likelihood of triggering this specific code path during high-load scenarios.