CVE-2026-98311

wifi: virt_wifi: don't transfer operstate before register

State: Published
Severity: 7.8 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: virt_wifi: don't transfer operstate before register

virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry.

Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c7cdba31ed8b87526db978976392802d3f93110c to before ee9ea1afd6990def51d52b3a0aecd5cfcc951da0Affected c7cdba31ed8b87526db978976392802d3f93110c to before 9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225Affected c7cdba31ed8b87526db978976392802d3f93110c to before f9526054c2b2cace5916b7225603d008834ec011Affected c7cdba31ed8b87526db978976392802d3f93110c to before e8304e25c6dabb8accf38b807969438d0ce84fd7Affected c7cdba31ed8b87526db978976392802d3f93110c to before ca49763c42c1089d654bf11b037980a9ede3772cAffected c7cdba31ed8b87526db978976392802d3f93110c to before 293c56a66510bb7de073a1aba388e38abddff1fbAffected c7cdba31ed8b87526db978976392802d3f93110c to before b808a9af5fd21f9c68b0d024eda7535b5dce6a4eAffected c7cdba31ed8b87526db978976392802d3f93110c to before e5c8d7acd31b27057ea42cd405d0b3ece097bc89Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c7cdba31ed8b87526db978976392802d3f93110c to before ee9ea1afd6990def51d52b3a0aecd5cfcc951da0Affected
c7cdba31ed8b87526db978976392802d3f93110c to before 9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225Affected
c7cdba31ed8b87526db978976392802d3f93110c to before f9526054c2b2cace5916b7225603d008834ec011Affected
c7cdba31ed8b87526db978976392802d3f93110c to before e8304e25c6dabb8accf38b807969438d0ce84fd7Affected
c7cdba31ed8b87526db978976392802d3f93110c to before ca49763c42c1089d654bf11b037980a9ede3772cAffected
c7cdba31ed8b87526db978976392802d3f93110c to before 293c56a66510bb7de073a1aba388e38abddff1fbAffected
c7cdba31ed8b87526db978976392802d3f93110c to before b808a9af5fd21f9c68b0d024eda7535b5dce6a4eAffected
c7cdba31ed8b87526db978976392802d3f93110c to before e5c8d7acd31b27057ea42cd405d0b3ece097bc89Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.