CVE-2026-98424 in Linux
Summary
by MITRE • 10/14/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: undo netns switch if renaming the wiphy fails
Once all the interfaces have been moved, cfg80211_switch_netns() moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. The rename can fail (but only on allocation failures), leaving things mixed up and hitting the warning there.
Ignoring it isn't great, undo the move and let the change fail in this case. If undo fails then WARN, then things would again be stuck in two different network namespaces.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The Linux kernel vulnerability identified within the wireless configuration subsystem involves a critical race condition during network namespace transitions for physical wireless devices represented by wiphy structures. When an administrator or system process initiates a move of all associated virtual interfaces to a new network namespace, the cfg80211_switch_netns function orchestrates this transition by first moving the individual interface objects and subsequently handling the underlying hardware device itself. This final step involves setting the network namespace for the wiphy object and triggering a rename operation that causes the system file system, or sysfs, to relocate the corresponding directory entry in the virtual filesystem hierarchy. The core technical flaw lies in the error handling logic surrounding this renaming process. Specifically, while most errors during such operations are handled gracefully, allocation failures can cause the rename operation to fail with an error code rather than succeeding silently. In previous implementations, if this specific failure occurred after the wiphy had already been logically moved to the new namespace but before it was successfully renamed in sysfs, the system would leave the device state inconsistent. The wiphy object would reside in the target network namespace while its representation in sysfs remained associated with the original namespace or became orphaned, leading to a mixed-up state that triggers kernel warnings and potentially destabilizes subsequent operations involving the wireless hardware.
This inconsistency represents a significant reliability issue because it violates the atomicity expected of administrative configuration changes. If an allocation failure occurs during the rename phase, the partial completion of the network namespace switch leaves the system in an ambiguous state where internal data structures point to one location while external filesystem representations point elsewhere or are invalid. This mismatch can lead to undefined behavior when subsequent kernel components attempt to access the wiphy through sysfs interfaces, potentially causing crashes, information leaks, or denial of service conditions for wireless management tools that rely on accurate device topology information. The vulnerability is particularly insidious because it only manifests under memory pressure scenarios where allocation failures are more likely, making it difficult to reproduce in stable environments but highly impactful when system resources are constrained. By ignoring the failure and proceeding with a partially completed state, the kernel exposes itself to logic errors that compromise the integrity of network configuration management.
From a classification perspective, this issue aligns closely with CWE-362, which describes concurrent execution issues leading to race conditions or inconsistent states, although it is more accurately characterized as an improper error handling sequence resulting in resource inconsistency. The failure to rollback changes upon partial success violates fundamental principles of transactional integrity within kernel subsystems. In the context of the MITRE ATT&CK framework for enterprise security, while this specific bug does not directly facilitate unauthorized access or privilege escalation by an external attacker, it impacts system availability and reliability, which are critical components of operational resilience. An adversary with local access could potentially exploit memory pressure conditions to trigger these allocation failures repeatedly, thereby causing instability in wireless management services or inducing kernel warnings that degrade system performance and observability.
The resolution implemented addresses this flaw by introducing a robust rollback mechanism within the cfg80211_switch_netns function. When the rename operation fails due to an allocation error, the code now explicitly undoes the network namespace switch for the wiphy object before returning the error code to the caller. This ensures that if any part of the transition process fails, the system reverts entirely to its previous consistent state rather than leaving it in a mixed configuration. Furthermore, the patch includes additional safety checks where if the rollback operation itself fails, which would indicate an even more severe internal inconsistency, a warning is issued to alert developers and administrators to this exceptional circumstance. This approach guarantees that network namespace transitions are either fully completed or completely reverted, preserving the integrity of both the kernel data structures and their sysfs representations.
To mitigate similar risks in other subsystems, it is essential to ensure that all state changes involving multiple components adhere to strict atomicity principles where partial failures trigger comprehensive rollbacks. Developers should audit code paths that modify system-wide configurations or resource associations to verify that error handling covers not just the immediate operation but also any preceding steps that altered global state. Regular stress testing under memory-constrained conditions can help identify such edge cases before they reach production environments. Additionally, maintaining clear separation between logical object states and their filesystem representations allows for easier debugging and more reliable recovery paths when errors occur during complex administrative operations involving network namespaces or device drivers.