CVE-2026-98331 wifi: mac80211: unlist vifs when their netdev is unregistered
HighCVSS 7.0
EPSS 0.13%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: unlist vifs when their netdev is unregistered
mac80211 only removes vifs from the local->interfaces list when
an interface is removed via ieee80211_if_remove(), before it
unregisters the netdev. However, it's possible for a netdev to
be unregistered without going through that: When the netns that
holds the wiphy is destroyed, the wiphy is supposed to move to
the init_ns, but that can run into allocation failures.
Then, mac80211 has an interface listed that doesn't exist, and
will eventually hit
BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()!
...
_cfg80211_unregister_wdev+0x24/0x36a [cfg80211]
cfg80211_unregister_wdev+0x15/0x1d [cfg80211]
ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]
ieee80211_unregister_hw+0x73/0x1d1 [mac80211]
mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]
Remove the interface from the list in ->ndo_uninit if it's still
around to avoid this.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < a22c02863439993095acd0c3db97fa53cd515f4f | a22c02863439993095acd0c3db97fa53cd515f4f |
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < 20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0 | 20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0 |
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < b735ad1a9aca6080192c1316cf2706e5e1318762 | b735ad1a9aca6080192c1316cf2706e5e1318762 |
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1 | d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1 |
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < 821bab0456dfca12acef6df702c8f2477d313227 | 821bab0456dfca12acef6df702c8f2477d313227 |
| Linux kernel | >= 463d018323851a608eef52a9427b0585005c647f, < eee2efd82867b623982ac51925b5a1812a74c50d | eee2efd82867b623982ac51925b5a1812a74c50d |
| Linux kernel | = 2.6.32 | No fix listed |
| Linux kernel | < 6.1.189 | 6.1.189 |
| Linux kernel | < 6.6.158 | 6.6.158 |
| Linux kernel | < 6.12.112 | 6.12.112 |
| Linux kernel | < 6.18.54 | 6.18.54 |
| Linux kernel | < 7.2.8 | 7.2.8 |
| Linux kernel | < 7.3 | 7.3 |
| redhat/kernel(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/kernel(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/kernel(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/kernel-rt(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/kernel(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/kernel-rt(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/kernel(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/kernel-rt(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) | All versions | No fix listed |
| debian/linux(Debian:12) | < 6.1.190-1 | 6.1.190-1 |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | = 6.1.106-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.112-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.115-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.119-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.123-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.124-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.128-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.129-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.133-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.135-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.137-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.139-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.140-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.147-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.148-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.153-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.158-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.159-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.162-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.164-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.172-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.174-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.176-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.177-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.180-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.187-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.27-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.37-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.52-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.64-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.66-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.67-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.82-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.85-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.98-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.99-1 | No fix listed |
| debian/linux(Debian:13) | < 6.12.113-1 | 6.12.113-1 |
| debian/linux(Debian:13) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | < 7.2.8-1 | 7.2.8-1 |
| debian/linux(Debian:14) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-2 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1~bpo13+1 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2546512 issue-tracking
- www.cve.org
- nvd.nist.gov
- git.kernel.org
- kernelcve.org
- USN-9040-1: Linux kernel (Low Latency NVIDIA) vulnerabilities vendor-advisory
- USN-9039-1: Linux kernel (Azure CVM) vulnerabilities vendor-advisory
- Debian Security Tracker CVE-2026-98331 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8959-1 vendor-advisory
- USN-8960-1 vendor-advisory
- USN-9066-1: Linux kernel (HWE) vulnerabilities vendor-advisory
- USN-9091-1: Linux kernel (NVIDIA Tegra) vulnerabilities vendor-advisory
- USN-9020-1 vendor-advisory
- USN-9023-1 vendor-advisory
- USN-9025-1 vendor-advisory
- USN-9022-1 vendor-advisory
- USN-9024-1 vendor-advisory
- USN-9026-1 vendor-advisory
- USN-9019-1 vendor-advisory
- USN-9021-1 vendor-advisory