CVE-2026-98346 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211.
To avoid that, invert the order of checks since wdev->netdev is always valid for beaconing interfaces.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified involves a critical null pointer dereference within the wireless networking subsystem, specifically affecting the cfg80211 and mac80211 components. The root cause lies in the function cfg80211_calculate_bi_data, which is responsible for calculating beacon interval data used by regulatory domains to determine radio mask constraints. This function invokes rdev_get_radio_mask passing wdev->netdev as an argument. However, not all wireless device structures (wdev) possess a corresponding network device structure; specifically, netdev-less virtual interfaces such as those used for monitoring or certain types of management frames do not have this association initialized. When the code attempts to access properties of a NULL pointer during the execution of rdev_get_radio_mask within the mac80211 driver stack, it triggers a kernel panic or crash, leading to system instability and denial of service conditions for any user relying on wireless connectivity at that moment.
This flaw represents a classic logic error where the assumption is made that all wireless devices are bound to network interfaces, which contradicts the flexible architecture of modern Linux wireless stacks. The operational impact includes immediate kernel crashes upon specific configuration changes or interface activations involving netdev-less wdevs. Such instability can disrupt critical infrastructure relying on consistent wireless availability and may allow a local attacker with sufficient privileges to trigger the condition intentionally for denial of service purposes. From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, as the code fails to properly validate pointer validity before use. Additionally, it relates to CWE-20 Improper Input Validation because the system does not adequately verify the state or attributes of the wdev object prior to processing.
In terms of attack vector classification under MITRE ATT&CK, this vulnerability falls under T1534 Internal Spearphishing if exploited via social engineering leading to local execution, but more accurately it is categorized under Local Privilege Escalation techniques where a low-privilege user might trigger the crash or potentially exploit memory corruption if further analysis reveals adjacent memory risks. However, primarily it serves as a Denial of Service vector (T1499 Endpoint Denial of Service) due to its ability to crash the host system without requiring external network interaction. The vulnerability highlights the importance of robust state checking in kernel subsystems that handle diverse device types with varying lifecycle states and associations.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects this logic error by reordering conditional checks within cfg80211_calculate_data(). By ensuring that wdev->netdev is validated or bypassed appropriately for beaconing interfaces where it is guaranteed to be valid, while skipping radio mask calculations for netdev-less devices, the crash condition is eliminated. System administrators should update their kernel packages to versions containing this fix immediately. For environments unable to patch quickly, restricting access to wireless configuration utilities and monitoring system logs for oops messages can help mitigate risk exposure until a full remediation cycle occurs. Regular auditing of kernel module parameters and strict enforcement of least privilege principles when managing network interfaces further reduces the attack surface associated with such internal logic flaws.