Live › vulnerability › CVE-2026-98822
Go to dashboardIn the Linux kernel's mac80211 Wi-Fi stack, unicast frames sent on one AP VLAN interface could match a station on a different VLAN of the same BSS and be transmitted to it. An attacker on the affected access point setup could get traffic meant for one VLAN delivered to a station in another VLAN.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running the Linux kernel as a Wi-Fi access point that uses AP VLAN interfaces are plausibly exposed, since the flaw is in how mac80211 picks the destination station for AP and AP VLAN frames. Clients, servers without Wi-Fi AP mode, and hosts without AP VLAN configuration are unlikely to be affected.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD entry.hostapd and iw dev, looking for AP/VLAN type interfaces).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: prevent AP VLAN tx from other interfaces
Since the station lookup was factored out of ieee80211_build_hdr(), ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN frames, not only for control port frames. A unicast frame sent on one interface thus matches a station of a different VLAN of the same BSS and is transmitted to it.
Only match stations of the interface the frame is sent on, except for control port frames, since those may be sent for VLAN stations directly on the BSS interface.
This page as .md · .json · in your agent: get_signal("CVE-2026-98822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.