Use-after-free in Linux kernel - CVE-2026-98311

Vulnerability details

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.

Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.

Affected software

How to mitigate CVE-2026-98311

External References

• https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb
• https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225
• https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e
• https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c
• https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89
• https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7
• https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0
• https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011

Related Security Bulletins

• Use-after-free in Linux kernel net wireless driver
• Debian update for linux