UBUNTU-CVE-2026-98182: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver is handed a monitor with no queue. ath9k dereferences it: BUG: kernel NULL pointer dereference, address: 0000000000000066 RIP: 0010:athtxnodeinit+0x49/0x170 [ath9k] ath9kaddinterface+0x10c/0x140 [ath9k] drvaddinterface+0x54/0x250 [mac80211] ieee80211doopen+0x32f/0x800 [mac80211] Reached with CAPNETADMIN by "iw dev X set monitor active" followed by "ip link set X up". RTNL is held, so netlink operations block behind it. Refuse the flag when there is no queue to give.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the ath9k wireless driver are affected when a user or process has CAP_NET_ADMIN and can manage monitor-mode interfaces. The vulnerable configuration involves a monitor interface that is down and has no transmit queue.
What action triggers the kernel fault?
An attacker needs to set a monitor interface active while it is down, then bring that interface up. The reported sequence is "iw dev X set monitor active" followed by "ip link set X up".
What can be done if the fix cannot be applied immediately?
Do not set the active-monitor flag on monitor interfaces while they are down. Prevent untrusted users or processes from obtaining CAP_NET_ADMIN where possible.
How can administrators recognize that this issue has been triggered?
The system may log a kernel NULL pointer dereference in ath9k, with ath_tx_node_init and ath9k_add_interface in the call trace. The fault occurs while opening the interface through mac80211.