« Volver al listado

CVE-2026-98311

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: virt_wifi: don't transfer operstate before register

virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry.

Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98311",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "ee9ea1afd6990def51d52b3a0aecd5cfcc951da0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "f9526054c2b2cace5916b7225603d008834ec011",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "e8304e25c6dabb8accf38b807969438d0ce84fd7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "ca49763c42c1089d654bf11b037980a9ede3772c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "293c56a66510bb7de073a1aba388e38abddff1fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "b808a9af5fd21f9c68b0d024eda7535b5dce6a4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c7cdba31ed8b87526db978976392802d3f93110c",
              "lessThan": "e5c8d7acd31b27057ea42cd405d0b3ece097bc89",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/virt_wifi.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/virt_wifi.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:22.573",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: don't transfer operstate before register\n\nvirt_wifi_newlink() calls netif_stacked_transfer_operstate() before\nregister_netdevice(). If the lower device is dormant, that queues the\nnew netdev on lweventlist while it is still uninitialized. If\nregistration fails after that, for example because of an invalid name\nsuch as \"bad/name\", free_netdev() immediately frees the object. A\nlater linkwatch_fire_event() then use-after-frees the list entry.\n\nMove the transfer to after netdev_upper_dev_link(), as macvlan and\nipvlan already do."
    }
  ],
  "lastModified": "2026-10-06T09:18:22.573",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}