{"id":"CVE-2026-98311","published":"2026-10-06T09:18:22.573","lastModified":"2026-10-07T07:17:08.473","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: don't transfer operstate before register\n\nvirt_wifi_newlink() calls netif_stacked_transfer_operstate() before\nregister_netdevice(). If the lower device is dormant, that queues the\nnew netdev on lweventlist while it is still uninitialized. If\nregistration fails after that, for example because of an invalid name\nsuch as \"bad/name\", free_netdev() immediately frees the object. A\nlater linkwatch_fire_event() then use-after-frees the list entry.\n\nMove the transfer to after netdev_upper_dev_link(), as macvlan and\nipvlan already do.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb","tags":[]},{"url":"https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225","tags":[]},{"url":"https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e","tags":[]},{"url":"https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c","tags":[]},{"url":"https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89","tags":[]},{"url":"https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7","tags":[]},{"url":"https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0","tags":[]},{"url":"https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability occurs in the Linux kernel's virtual WiFi implementation where the operational state transfer happens before device registration, leading to use-after-free conditions when registration fails. This can result in system instability or potential privilege escalation.","exploitability":"Exploitation is moderately difficult and requires specific conditions including creating a malformed network device with an invalid name that triggers the registration failure path.","blast_radius":"The impact is limited to systems running virtual WiFi devices with specific configurations, but could affect network stability and potentially allow privilege escalation in vulnerable kernel versions.","remediation":"Upgrade to Linux kernel version 6.10 or later which contains the fix for this use-after-free vulnerability in virt_wifi driver.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","network","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:03:44.808Z"}}