CVE-2026-98331

wifi: mac80211: unlist vifs when their netdev is unregistered

State: Published
Severity: 7.0 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: unlist vifs when their netdev is unregistered

mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unregisters the netdev. However, it's possible for a netdev to be unregistered without going through that: When the netns that holds the wiphy is destroyed, the wiphy is supposed to move to the init_ns, but that can run into allocation failures.

Then, mac80211 has an interface listed that doesn't exist, and will eventually hit

BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()! ... _cfg80211_unregister_wdev+0x24/0x36a [cfg80211] cfg80211_unregister_wdev+0x15/0x1d [cfg80211] ieee80211_remove_interfaces+0x1ff/0x257 [mac80211] ieee80211_unregister_hw+0x73/0x1d1 [mac80211] mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]

Remove the interface from the list in ->ndo_uninit if it's still around to avoid this.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	463d018323851a608eef52a9427b0585005c647f to before a22c02863439993095acd0c3db97fa53cd515f4fAffected 463d018323851a608eef52a9427b0585005c647f to before 20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0Affected 463d018323851a608eef52a9427b0585005c647f to before b735ad1a9aca6080192c1316cf2706e5e1318762Affected 463d018323851a608eef52a9427b0585005c647f to before d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1Affected 463d018323851a608eef52a9427b0585005c647f to before 821bab0456dfca12acef6df702c8f2477d313227Affected 463d018323851a608eef52a9427b0585005c647f to before eee2efd82867b623982ac51925b5a1812a74c50dAffected
LinuxLinux	2.6.32Affected before 2.6.32Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

463d018323851a608eef52a9427b0585005c647f to before a22c02863439993095acd0c3db97fa53cd515f4fAffected
463d018323851a608eef52a9427b0585005c647f to before 20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0Affected
463d018323851a608eef52a9427b0585005c647f to before b735ad1a9aca6080192c1316cf2706e5e1318762Affected
463d018323851a608eef52a9427b0585005c647f to before d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1Affected
463d018323851a608eef52a9427b0585005c647f to before 821bab0456dfca12acef6df702c8f2477d313227Affected
463d018323851a608eef52a9427b0585005c647f to before eee2efd82867b623982ac51925b5a1812a74c50dAffected

LinuxLinux

2.6.32Affected
before 2.6.32Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.