CVE-2026-98311

Summary

This vulnerability occurs in the Linux kernel's virtual WiFi implementation where the operational state transfer happens before device registration, leading to use-after-free conditions when registration fails. This can result in system instability or potential privilege escalation.

Exploitability

Exploitation is moderately difficult and requires specific conditions including creating a malformed network device with an invalid name that triggers the registration failure path.

Blast radius

The impact is limited to systems running virtual WiFi devices with specific configurations, but could affect network stability and potentially allow privilege escalation in vulnerable kernel versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Linux kernel version 6.10 or later which contains the fix for this use-after-free vulnerability in virt_wifi driver.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.