CVE-2026-98422

Received Received - Intake

Wi-Fi AP_VLAN Tailroom Counter Reset on ifdown in Linux Kernel

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown On ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the same AP_VLAN up again will increment the counter again and eventually hit the sanity check: WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt != master->crypto_tx_tailroom_needed_cnt); Reset it on ifdown to avoid that.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98422

EUVD

EUVD-2026-101071

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	f9dca80b98caac8b4bfb43a2edf1e9f877ccf322
Linux	Linux	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a counter issue in AP_VLAN interfaces. When an AP_VLAN interface is brought up, it copies a counter value from the main AP interface but never decrements it when the AP_VLAN is brought down. This causes the counter to increment incorrectly when the interface is reused, eventually triggering a warning or failure.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and AP_VLAN interfaces. Detection requires checking kernel logs for the WARN_ON_ONCE message indicating the tailroom counter mismatch. Monitor logs with 'dmesg | grep -i tailroom' or 'journalctl -k | grep -i tailroom'.

Impact Analysis

This vulnerability could cause system instability or crashes when AP_VLAN interfaces are frequently brought up and down. It may lead to unexpected warnings or errors in the kernel logs, potentially disrupting network services that rely on these interfaces.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level kernel issue affecting WiFi AP_VLAN interfaces. It causes a warning in the kernel but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update your kernel to a version containing the fix. If immediate patching is not possible, avoid frequent AP_VLAN interface restarts to prevent the counter from reaching the sanity check threshold.

Hi! I’m here to help you understand CVE-2026-98422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70