CVE-2026-98822

Received Received - Intake

Denial of Service in Linux Kernel WiFi Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211_build_hdr(), ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN frames, not only for control port frames. A unicast frame sent on one interface thus matches a station of a different VLAN of the same BSS and is transmitted to it. Only match stations of the interface the frame is sent on, except for control port frames, since those may be sent for VLAN stations directly on the BSS interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98822

EUVD

EUVD-2026-103907

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	97ffe75791b3e9c0797d5891070e41321c3beccb
Linux	Linux	97ffe75791b3e9c0797d5891070e41321c3beccb
Linux	Linux	97ffe75791b3e9c0797d5891070e41321c3beccb
Linux	Linux	97ffe75791b3e9c0797d5891070e41321c3beccb
Linux	Linux	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac80211 subsystem where AP VLAN transmissions can be sent from unintended interfaces. The issue arises because station lookup no longer checks the interface for AP and AP VLAN frames, allowing unicast frames from one interface to be incorrectly transmitted to stations on different VLANs within the same BSS.

Detection Guidance

This vulnerability involves incorrect station matching in AP VLAN frames, which could lead to unauthorized frame transmission. Detection requires checking kernel logs for unusual wireless frame handling or misrouted traffic. Use commands like 'dmesg | grep mac80211' or 'journalctl -k | grep mac80211' to inspect kernel logs for related errors. Monitor wireless interface traffic with 'tcpdump -i wlan0' or similar to detect unexpected frame transmissions.

Impact Analysis

This vulnerability could allow unauthorized network traffic to be sent to unintended VLANs, potentially leading to data leakage or network disruption. Attackers might exploit it to intercept or redirect sensitive data transmitted over Wi-Fi.

Compliance Impact

This vulnerability allows unicast frames sent on one interface to be transmitted to stations of a different VLAN within the same BSS, potentially causing unauthorized data exposure. This could violate data isolation requirements under GDPR and HIPAA by enabling unintended access to sensitive information across VLANs.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If updating is not immediately possible, restrict wireless network access or disable AP VLAN functionality temporarily until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70