CVE-2026-98331wifi: mac80211: unlist vifs when their netdev is unregistered
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.13%, higher than 2% of scored CVEs.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures. Then, mac80211 has an interface listed that doesn't exist, and will eventually hit BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211] cfg80211_unregister_wdev+0x15/0x1d [cfg80211] ieee80211_remove_interfaces+0x1ff/0x257 [mac80211] ieee80211_unregister_hw+0x73/0x1d1 [mac80211] mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim] Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.13% (percentile 2)
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 463d018323851a608eef52a9427b0585005c647f before a22c02863439993095acd0c3db97fa53cd515f4f; 463d018323851a608eef52a9427b0585005c647f builds before 20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0; from 463d018323851a608eef52a9427b0585005c647f before b735ad1a9aca6080192c1316cf2706e5e1318762; from 463d018323851a608eef52a9427b0585005c647f before d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1; from 463d018323851a608eef52a9427b0585005c647f before 821bab0456dfca12acef6df702c8f2477d313227; from 463d018323851a608eef52a9427b0585005c647f before eee2efd82867b623982ac51925b5a1812a74c50d | CNA record |
References
- https://git.kernel.org/stable/c/a22c02863439993095acd0c3db97fa53cd515f4f
- https://git.kernel.org/stable/c/20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0
- https://git.kernel.org/stable/c/b735ad1a9aca6080192c1316cf2706e5e1318762
- https://git.kernel.org/stable/c/d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1
- https://git.kernel.org/stable/c/821bab0456dfca12acef6df702c8f2477d313227
- https://git.kernel.org/stable/c/eee2efd82867b623982ac51925b5a1812a74c50d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.