Linux Kernel CVE-2026-98311

Requires: (1) local access with the ability to create virtual network interfaces - effectively CAP_NET_ADMIN in a network namespace, which an unprivileged user may obtain via user namespaces on some distributions; (2) the virt_wifi module must be available/loaded, which is uncommon outside test, ChromeOS/Android-style, or development environments; (3) the chosen lower device must be in the dormant operstate so the stacked operstate transfer queues the netdev on the linkwatch event list; and (4) the attacker must force register_netdevice() to fail after that point, which is attacker-controllable by passing an invalid interface name such as 'bad/name'. Limiting factors: exploitation is strictly local (not remote), depends on the rarely-deployed virt_wifi driver being present, and requires network-admin capability - these substantially narrow realistic exposure despite the 7.8 score.

This is a local use-after-free in the Linux kernel's virt_wifi driver (CVE-2026-98311). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-reachable, low-privilege flaw with full confidentiality, integrity and availability impact - consistent with a kernel memory-corruption bug that can enable privilege escalation. However, exploitation signals point to LOW real-world urgency: EPSS is only 0.22% (11th percentile), there is NO CISA KEV listing, and no public exploit code is identified in the provided data. Exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (low EPSS + no KEV + local-only vector), so this is best treated as a patch-in-normal-cycle hardening fix rather than an emergency. Two caveats: (1) the vector is AV:L and PR:L, meaning an attacker must already have local code execution with the ability to create virtual network links (CAP_NET_ADMIN, potentially obtainable via unprivileged user namespaces) - this is not remotely exploitable despite the high impact scores; (2) reliably weaponizing a UAF-via-linkwatch into code execution is non-trivial, so the H/H/H impact represents worst-case potential, not demonstrated exploitation. CWE is unpopulated in the input; the description makes this unambiguously a use-after-free (CWE-416).

A local attacker with the ability to create network links (e.g., CAP_NET_ADMIN, possibly via an unprivileged user namespace) creates a virt_wifi device over a lower interface that is in the dormant state, then forces register_netdevice() to fail by supplying an invalid name such as 'bad/name'. The netdev is freed while still queued on the linkwatch event list, and a subsequent linkwatch_fire_event() dereferences the freed list entry, corrupting kernel memory for potential privilege escalation. No public exploit code is identified at time of analysis.