{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98073 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98073 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98073 and fix it if it is affected.\n\nWhat it is: CVE-2026-98073 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98073 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98073/ (Markdown: https://insights.sbomify.com/CVE-2026-98073/index.md)","id":"CVE-2026-98073","markdown":"https://insights.sbomify.com/CVE-2026-98073/index.md","name":"CVE-2026-98073","record":{"aliases":["AZL-104265","BELL-CVE-2026-98073","DEBIAN-CVE-2026-98073","GHSA-g33p-j5vg-7cwx","UBUNTU-CVE-2026-98073"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel networking","requires_auth":"low_privilege","summary":"A kernel bug in network namespace cleanup causes a warning and potential crash when removing namespaces with conflicting device altnames.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n\nsyzbot reported the warning in cfg80211_pernet_exit(). [0]\n\nThe repro does the following:\n\n  1. create two device in root netns and non-root netns\n  2. assign the same altname for the two devices\n  3. remove the non-root netns\n\nSince commit 7663d522099e (\"net: check for altname conflicts\nwhen changing netdev's netns\"), cfg80211_switch_netns() and\ncfg802154_switch_netns() fail if init_net has a device with the\nconflicting altname.\n\ndefault_device_exit_net() had the same issue and commit d09486a04f5d\n(\"net: fix removing a namespace with conflicting altnames\") fixed it.\n\ncfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.\n\nLet's generalise the fix by removing conflicting altnames for dying\nnetns in __dev_change_net_namespace().\n\n[0]:\ncfg80211_switch_netns(rdev, \u0026init_net)\nWARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160\nModules linked in:\nCPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 \u003c0f\u003e 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20\nFS:  0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253\n cleanup_net+0x572/0x810 net/core/net_namespace.c:706\n process_one_work kernel/workqueue.c:3387 [inline]\n process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551\n kthread+0x38b/0x480 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().","id":"CVE-2026-98073","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"bonding: do not clear curr_active_slave prematurely when releasing all slaves","id":"CVE-2026-98074"},"packages":[],"prev":{"headline":"net/rds: use wq_has_sleeper() in release_in_xmit()","id":"CVE-2026-98072"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A kernel bug in network namespace cleanup causes a warning and potential crash when removing namespaces with conflicting device altnames.","url":"https://insights.sbomify.com/CVE-2026-98073/"}