CVE-2026-98346: Linux kernel · wifi: cfg80211: don't get the radio mask for netdev-less wdevs
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in a7783e585360ee05dfe21d3173dbbe985c94f29e : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in a7783e585360ee05dfe21d3173dbbe985c94f29e, 7166da84a7fe3553f9065782fd80299a37b150e5, 693d777846d525b8b218bad97a1befa5d9bd4334 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to a7783e585360ee05dfe21d3173dbbe985c94f29e, 7166da84a7fe3553f9065782fd80299a37b150e5, 693d777846d525b8b218bad97a1befa5d9bd4334 or 5b313159c970e945ee125ca87fad0d96ed913e55.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix for this vulnerability is available in the Linux kernel. The issue has been resolved in the commits identified by hashes a7783e585360ee05dfe21d3173dbbe985c94f29e, 7166da84a7fe3553f9065782fd80299a37b150e5, 693d777846d525b8b218bad97a1befa5d9bd4334, and 5b313159c970e945ee125ca87fad0d96ed913e55. Users and administrators should update to a Linux kernel version including these fixes. No additional mitigation is indicated.
Description
A vulnerability in the Linux kernel's wifi cfg80211 subsystem caused a crash when attempting to get the radio mask for wireless devices without an associated network device. This was due to a null pointer dereference in the function cfg80211_calculate_bi_data() when calling rdev_get_radio_mask() with a null netdev pointer. The issue was fixed by changing the order of checks to ensure wdev->netdev is valid before use.
References
- git.kernel.org/stable/c/5b313159c970e945ee125ca87fad0d96ed913e55 (opens in a new tab)
- git.kernel.org/stable/c/693d777846d525b8b218bad97a1befa5d9bd4334 (opens in a new tab)
- git.kernel.org/stable/c/7166da84a7fe3553f9065782fd80299a37b150e5 (opens in a new tab)
- git.kernel.org/stable/c/a7783e585360ee05dfe21d3173dbbe985c94f29e (opens in a new tab)