Description

In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: don't transfer operstate before register virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry. Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-06T09:18:22.573Z",
  "pubdate": "2026-10-06T09:18:22.573Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel virt_wifi driver due to improper ordering of network device registration processes.\nThe vulnerability allows an attacker capable of triggering interface creation with specific conditions to cause a kernel memory corruption issue.\nThe flaw specifically involves the misuse of netif_stacked_transfer_operstate() when a network device is in an uninitialized state.\nExploitation of this flaw could potentially lead to a system crash (kernel panic) or arbitrary memory access, resulting in a denial-of-service condition or potential privilege escalation.\nThe issue affects the lifecycle management of network interfaces, specifically where device registration failure occurs after operation state transfers have been queued.\nThe risk is categorized as high due to the potential for memory instability within the kernel address space.",
  "technicalDetails": "The root cause of the vulnerability resides in the virt_wifi_newlink() function within the Linux kernel's virt_wifi driver. The implementation incorrectly invokes netif_stacked_transfer_operstate() prior to the successful completion of register_netdevice().\nWhen a lower device is marked as dormant, calling netif_stacked_transfer_operstate() triggers an internal queuing process that adds the new net_device object to the lweventlist. At this stage, the net_device structure remains uninitialized and is not yet fully managed by the kernel's network stack.\nIf the subsequent register_netdevice() call fails—for instance, due to an invalid device naming convention such as 'bad/name'—the kernel executes free_netdev() to deallocate the memory associated with the network device structure. However, because the device was previously queued on the lweventlist, the reference to the now-freed memory persists within that list.\nThe vulnerability manifests when the kernel's linkwatch mechanism later triggers linkwatch_fire_event(). This function attempts to process the event list and accesses the stale, deallocated pointer originally associated with the unregistered network device. This results in a use-after-free (UAF) condition.\nThe attack flow requires an actor with sufficient privileges to initiate the creation of a virt_wifi network device with an intentionally malformed name or other parameters that ensure registration failure. By triggering this sequence, an attacker can manipulate the kernel's linkwatch queue to reference invalid memory. Post-exploitation, this typically results in a kernel panic; however, if the memory is reallocated and populated with attacker-controlled data before the linkwatch event is fired, it may enable arbitrary code execution within the kernel context.\nThis vulnerability highlights a flaw in the lifecycle synchronization of stacked network devices. The remediation requires reordering the operations to ensure that netif_stacked_transfer_operstate() is only executed after a successful netdev_upper_dev_link() call, aligning the virt_wifi driver's behavior with more robust implementations like macvlan and ipvlan."
}