EUVD-2026-93315
GHSA-hpc6-p9x9-m2fc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access with netns capability
-
DeliveryAttach wiphy to a new network namespace
-
ExploitDestroy namespace under memory pressure
-
ExecutionInterface move fails, leaving garbage netns pointer
-
PersistDereference in wiphy_unregister
-
ImpactKernel panic (denial of service)
Vulnerability Assessment
| Exploitation Conditions | Requires local access on a Linux host whose kernel includes the cfg80211 wifi subsystem, plus the ability to create and destroy network namespaces containing a wiphy (e.g. CAP_NET_ADMIN or an unprivileged user namespace that permits it). The critical trigger is a memory allocation failure during __dev_change_net_namespace while moving the interface back to the initial namespace on netns teardown - only then is the wiphy left with a garbage netns pointer. Limiting factors: no remote vector (local only), low-but-nonzero privilege needed for namespace manipulation, hardware/driver dependency on an actual wiphy, and the allocation-failure precondition cannot be forced deterministically (hence high attack complexity), making reliable exploitation hard. |
| Impact | This is a genuine but low-priority defensive-patch issue rather than an actively-threatening vulnerability. The signals align consistently toward low real-world risk: the CVSS 3.1 vector (AV:L/AC:H/PR:L) requires local access, low privileges, AND a high-complexity precondition (a memory allocation failure during the interface move), EPSS is only 0.17% (6th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced. Exploitation status: no public exploit identified at time of analysis. The upstream CVSS base score of 7.0 with C:H/I:H/A:H appears generous relative to the described defect, which is a kernel-mode fault (wild/garbage netns pointer dereference in wiphy_unregister) - the realistic primary impact is a kernel crash/denial of service, with memory-corruption-driven escalation being theoretical and non-trivial. CONFLICT TO VERIFY: the input Tag 'Information Disclosure' does not match the described crash-type defect (a garbage pointer dereference causing a kernel fault), so the triad C:H/I:H/A:H and the information-disclosure framing should be treated skeptically. Priority is routine kernel-update hygiene, not emergency patching. |
| Exploit ScenarioDerived | A local user on a multi-tenant Linux host with wifi (cfg80211) support creates a network namespace, attaches a wiphy to it, and then destroys the namespace while the system is under memory pressure so the kernel's attempt to move the interface back to the initial namespace fails. The wiphy is then left with a stale/garbage netns pointer, and the subsequent wiphy_unregister path dereferences it, panicking the kernel. No public proof-of-concept is referenced, and the required allocation-failure race makes reliable triggering difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
RemediationAI
Apply the vendor-released patch by upgrading to Linux 6.18.54 or 7.2.8 (or 7.3-rc4 and later) on affected branches, or backport the upstream fixes at https://git.kernel.org/stable/c/b949b2720688691f1e41bdbfbe3df2b6dc77c34d, https://git.kernel.org/stable/c/caa02072b2986d4b0e7a824de05782ef7b03a0ba and https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52. If immediate kernel updates are not feasible, constrain the trigger surface: restrict unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) so non-root users cannot create the network namespaces that carry a wiphy - this breaks container runtimes and sandboxes that rely on unprivileged userns, so it should be scoped to hosts without such workloads; alternatively, on hosts that do not need wireless functionality, blacklist or do not load the cfg80211/mac80211 modules (and associated drivers) to eliminate the wiphy path entirely, at the cost of losing Wi-Fi. Because exploitation also requires an allocation failure during __dev_change_net_namespace(), avoiding aggressive netns churn on memory-pressured systems reduces the practical exposure, but no mitigation other than the kernel fix removes the dangling-pointer condition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cfg80211 is the kernel's wireless configuration core; it exposes wiphy (wireless PHY) objects to userspace through the nl80211 generic netlink family and hooks into per-network-namespace lifecycle via pernet_operations. On netns destruction, cfg80211_pernet_exit() attempts to move any wiphy still resident in that namespace back to the initial namespace and previously only emitted a warning if the move failed. That move relies on __dev_change_net_namespace(), which can fail under memory pressure; when it does, the wiphy keeps a dangling struct net pointer. Subsequent netlink multicast activity (genlmsg_multicast_netns via nl80211_notify_wiphy during wiphy_unregister) then dereferences the stale pointer, faulting at offset 0x30 - a classic dangling-pointer/memory-safety defect (CWE not provided in the source data). The fix removes, rather than forcibly relocates, interfaces that cannot be moved so the wiphy is never left with a garbage netns reference; the netdev core unregisters those interfaces anyway. A related path was previously addressed by commit debac3a20dec ("net: Remove conflicting altnames for dying netns in __dev_change_net_namespace()."). The affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline kernel tree including its stable branches.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local only (AV:L), needs netns privileges (PR:L) and a hard-to-force allocation failure (AC:H); realistic impact is a kernel panic (A:H) with no confirmed confidentiality/integrity loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: get the wiphy out of a dying network namespace
When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fail (due to allocation failures), and then the wiphy is left behind with a garbage netns pointer:
Kernel mode fault at addr 0x30 genlmsg_multicast_netns.constprop.0+0x46/0xcf [cfg80211] nl80211_notify_wiphy+0xcd/0xe8 [cfg80211] wiphy_unregister+0x169/0x3fc [cfg80211]
Note that commit debac3a20dec ("net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().") fixed another path that could reach it without allocation failures.
Remove interfaces that cannot be moved instead of failing the switch, so that the wiphy always ends up in the initial namespace. In this case the netdev core will unregister the interfaces anyway.
Executive ViewAI
A flaw in the Linux kernel's cfg80211 wireless configuration subsystem can allow a local user with low privileges to crash an affected host, producing a denial-of-service condition on systems that manage wireless network namespaces. Leadership should care because the impact is service availability rather than data exposure: a successful trigger takes the machine down, and the affected population is any Linux server, wireless controller, or embedded device running an unpatched kernel in scope for enterprise operations. Exploitation requires local access and precise timing, and no public exploit or active exploitation has been observed, so this is a scheduled remediation item rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB