CVE-2026-98331

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: unlist vifs when their netdev is unregistered

mac80211 only removes vifs from the local->interfaces list when

an interface is removed via ieee80211_if_remove(), before it

unregisters the netdev. However, it's possible for a netdev to

be unregistered without going through that: When the netns that

holds the wiphy is destroyed, the wiphy is supposed to move to

the init_ns, but that can run into allocation failures.

Then, mac80211 has an interface listed that doesn't exist, and

will eventually hit

BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()!

...

_cfg80211_unregister_wdev+0x24/0x36a [cfg80211]

cfg80211_unregister_wdev+0x15/0x1d [cfg80211]

ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]

ieee80211_unregister_hw+0x73/0x1d1 [mac80211]

mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]

Remove the interface from the list in ->ndo_uninit if it's still

around to avoid this.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References