EUVD-2026-93316
GHSA-wm55-5w39-6wj2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local namespace-admin (CAP_NET_ADMIN)
-
DeliveryRegister mac80211 vif inside a netns
-
ExploitDestroy netns to force wiphy migration
-
ExecutionHit allocation failure leaving stale vif
-
PersistDereference stale interface (BUG/UAF)
-
ImpactKernel panic / denial of service
Vulnerability Assessment
| Exploitation Conditions | Requires a system running the mac80211 WiFi stack (a soft-MAC driver or mac80211_hwsim) and a local actor able to create a network namespace that holds the wiphy and then tear it down. The decisive trigger is a memory-allocation failure while the kernel moves the wiphy back to init_ns during netns destruction - this leaves a stale vif in local->interfaces that is later dereferenced. Limiting factors: no remote vector (AV:L, local only), namespace-administration privileges required (PR:L), the allocation-failure condition is largely outside attacker control and inherently racy/non-deterministic (AC:H), and only kernels with mac80211 loaded in the affected version ranges are exposed. |
| Impact | Signals converge on LOW real-world priority despite the 7.0 (HIGH) CVSS. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N is itself a limiting profile: local access only (AV:L), high attack complexity (AC:H), and some privileges required (PR:L). EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation-likelihood signals agree this is not under active or imminent exploitation. No SSVC decision data was supplied. The claimed C:H/I:H/A:H impact conflicts with the description, which describes a kernel BUG()/stale-list dereference (a use-after-free style crash) triggered on an error path - that reads as an availability/robustness fix, not an information-disclosure or code-execution primitive, so the full-triad score is the conservative upstream default rather than a demonstrated outcome. Critically, the trigger depends on an allocation failure while a wiphy is moved back to init_ns during netns teardown - a condition largely outside an attacker's control - which makes reliable weaponization unlikely. Net: a legitimate robustness bug worth patching in the normal kernel-update cycle, not an emergency. |
| Exploit ScenarioDerived | A local user with network-namespace administrative capability creates a namespace holding a mac80211 wiphy and then destroys it; if the kernel hits an allocation failure while migrating the wiphy to init_ns, mac80211 retains a stale interface entry and later dereferences it, hitting wiphy_to_rdev() BUG() and crashing the host. No public exploit code exists, and the dependence on a memory-allocation failure makes deterministic triggering difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
RemediationAI
Vendor-released patch: Linux 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 (and 7.3-rc4) - apply via your distribution's kernel update or cherry-pick the stable commits linked from https://git.kernel.org/stable/c/a22c02863439993095acd0c3db97fa53cd515f4f, https://git.kernel.org/stable/c/20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0, https://git.kernel.org/stable/c/b735ad1a9aca6080192c1316cf2706e5e1318762, https://git.kernel.org/stable/c/d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1, https://git.kernel.org/stable/c/821bab0456dfca12acef6df702c8f2477d313227 and https://git.kernel.org/stable/c/eee2efd82867b623982ac51925b5a1812a74c50d, referenced from https://nvd.nist.gov/vuln/detail/CVE-2026-98331. Because exploitation needs namespace privileges and a wiphy-bearing netns teardown, meaningful compensating controls are to restrict who can create network namespaces - set kernel.unprivileged_userns_clone=0 and/or user.max_user_namespaces=0 where workloads do not require nested netns, or gate CAP_SYS_ADMIN/CAP_NET_ADMIN via seccomp or container policy; the trade-off is that this breaks container runtimes, VPN/network tooling and any legitimate namespace use. In environments that do not need virtual wireless testing, stop loading mac80211_hwsim (blacklist the module) and, where WiFi is unused, avoid loading mac80211/cfg80211 altogether on sensitive hosts - this removes the attack surface entirely at the cost of losing wireless functionality. Note that the decisive allocation-failure trigger is racy and largely outside attacker control, so these are exposure-reduction measures rather than reliable exploit blockers; there is no configuration switch that deterministically prevents the stale-vif state, which makes upgrading the authoritative fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mac80211 is the kernel's soft-MAC 802.11 implementation that sits above cfg80211 (the wireless configuration/nl80211 layer) and below the hardware drivers such as mac80211_hwsim, iwlwifi or ath9k. Each wireless netdev is represented internally as a virtual interface (vif) tracked in the per-device local->interfaces list, which mac80211 normally prunes in ieee80211_if_remove() before the netdev is unregistered. The defect is a lifetime/consistency bug: when the network namespace that owns a wiphy is destroyed, cfg80211 is supposed to relocate the wiphy to init_ns, and if that relocation fails on an allocation error, the netdev is unregistered without ever passing through ieee80211_if_remove(), leaving a dangling vif in local->interfaces. Later teardown (for example mac80211_hwsim_del_radio calling ieee80211_unregister_hw -> ieee80211_remove_interfaces -> cfg80211_unregister_wdev -> _cfg80211_unregister_wdev) dereferences a wiphy whose backing rdev is no longer valid, tripping the WARN/BUG assertion in wiphy_to_rdev() at net/wireless/core.h:141; the input supplies no CWE, but the pattern is consistent with use-after-free / improper resource lifetime management (cf. CWE-416) compounded by a reachable assertion (cf. CWE-617). The upstream resolution simply removes the interface from the list in the netdev ->ndo_uninit callback if it is still present, closing the window between netdev unregistration and mac80211 bookkeeping, with the fix lineage anchored at commit 463d018323851a608eef52a9427b0585005c647f and backports in the stable trees.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only trigger (AV:L) gated by an attacker-uncontrolled allocation failure (AC:H) and namespace-admin privileges (PR:L); primary effect is a kernel crash (A:H) with only incidental memory-safety impact (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: unlist vifs when their netdev is unregistered
mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures.
Then, mac80211 has an interface listed that doesn't exist, and will eventually hit
BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211] cfg80211_unregister_wdev+0x15/0x1d [cfg80211] ieee80211_remove_interfaces+0x1ff/0x257 [mac80211] ieee80211_unregister_hw+0x73/0x1d1 [mac80211] mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]
Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.
Executive ViewAI
A high-severity Linux kernel mac80211 flaw can cause a crash or memory corruption when a network namespace holding a wireless physical device is destroyed and a racy memory-allocation failure prevents the device from migrating back to the initial namespace. Exploitation requires local authenticated access with namespace-administration privileges and an attacker-uncontrollable race, so broad enterprise exposure is limited, but unpatched Linux hosts using mac80211 could still face availability loss or memory-integrity issues. Leadership should treat this as a low real-world priority while ensuring affected Linux assets are identified and updated through standard patch management, especially since no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB