CVE-2026-98330: wifi: cfg80211: get the wiphy out of a dying network namespace
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: get the wiphy out of a dying network namespace
When a network namespace is destroyed, cfg80211pernetexit() moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fail (due to allocation failures), and then the wiphy is left behind with a garbage netns pointer:
Kernel mode fault at addr 0x30 genlmsgmulticastnetns.constprop.0+0x46/0xcf [cfg80211] nl80211notifywiphy+0xcd/0xe8 [cfg80211] wiphyunregister+0x169/0x3fc [cfg80211]
Note that commit debac3a20dec ("net: Remove conflicting altnames for dying netns in devchangenetnamespace().") fixed another path that could reach it without allocation failures.
Remove interfaces that cannot be moved instead of failing the switch, so that the wiphy always ends up in the initial namespace. In this case the netdev core will unregister the interfaces anyway.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the fault?
A network namespace must be destroyed while a wiphy is being moved back to the initial namespace, and moving an associated interface must fail. The described failure case is allocation failure during the interface move, which can leave the wiphy with an invalid network-namespace pointer.
What is the impact if the issue is triggered?
Later cfg80211 activity can dereference the stale network-namespace pointer and cause a kernel-mode fault. The supplied trace shows this can occur through nl80211 notification handling during wiphy unregistration.
What mitigation is available if the fix cannot be applied immediately?
The data does not provide a configuration workaround. Avoiding destruction of network namespaces containing affected wireless interfaces would avoid the described trigger path.
How does the fix prevent the issue?
If an interface cannot be moved to the initial namespace, the fix removes the interface rather than leaving the wiphy in the dying namespace. The network-device core will unregister those interfaces, ensuring the wiphy ends up in the initial namespace.