{"id":"CVE-2026-98822","kind":"vulnerability","aliases":["CVE-2026-98822"],"related":[],"title":"Linux kernel: wifi AP VLAN frames can be sent to the wrong station","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: prevent AP VLAN tx from other interfaces\n\nSince the station lookup was factored out of ieee80211_build_hdr(),\nieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN\nframes, not only for control port frames. A unicast frame sent on one\ninterface thus matches a station of a different VLAN of the same BSS and\nis transmitted to it.\n\nOnly match stations of the interface the frame is sent on, except for\ncontrol port frames, since those may be sent for VLAN stations directly\non the BSS interface.","summary":"In the Linux kernel's mac80211 Wi-Fi stack, unicast frames sent on one AP VLAN interface could match a station on a different VLAN of the same BSS and be transmitted to it. An attacker on the affected access point setup could get traffic meant for one VLAN delivered to a station in another VLAN.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","mac80211","runtime","self-hosted","wifi"],"not_affected_if":["no-ap-vlan","no-wifi-access-point"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- Check whether the host runs a Wi-Fi access point with AP VLAN interfaces (for example with `hostapd` and `iw dev`, looking for `AP/VLAN` type interfaces).","fix":"- Update the Linux kernel to a build that includes the mac80211 commit 'prevent AP VLAN tx from other interfaces' (version unknown from the sources; check the NVD or distribution advisory).","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:42+00:00","updated_at":"2026-10-25T05:14:42+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:14:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a build that includes the mac80211 commit 'prevent AP VLAN tx from other interfaces' (version unknown from the sources; check the NVD or distribution advisory).","reach":"network","title":"Linux kernel: wifi AP VLAN frames can be sent to the wrong station","impact":"low","summary":"In the Linux kernel's mac80211 Wi-Fi stack, unicast frames sent on one AP VLAN interface could match a station on a different VLAN of the same BSS and be transmitted to it. An attacker on the affected access point setup could get traffic meant for one VLAN delivered to a station in another VLAN.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","wifi","mac80211","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Frames for one VLAN station are delivered to a station on another VLAN.","analyst_note":"Confirm the fixed kernel versions and stable backport list from the NVD or kernel.org stable commit for this CVE.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- Check whether the host runs a Wi-Fi access point with AP VLAN interfaces (for example with `hostapd` and `iw dev`, looking for `AP/VLAN` type interfaces).","needs_analyst":true,"not_affected_if":["no-wifi-access-point","no-ap-vlan"],"who_is_affected":"Only systems running the Linux kernel as a Wi-Fi access point that uses AP VLAN interfaces are plausibly exposed, since the flaw is in how mac80211 picks the destination station for AP and AP VLAN frames. Clients, servers without Wi-Fi AP mode, and hosts without AP VLAN configuration are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":3436,"output_tokens":685,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98822':16A,19A 'access':68B 'affect':67B 'anoth':83B 'ap':4A,43B,98C,126C,128C 'attack':64B 'bss':57B,123C,155C,188C 'build':113C 'control':134C,174C 'could':46B,71B 'cve':14A,17A 'deliv':78B 'differ':52B,150C 'direct':185C 'except':172C 'factor':109C 'fi':36B 'follow':90C 'frame':6A,39B,130C,136C,139C,168C,176C 'get':72B,122C 'hdr':114C 'host':26B 'ieee80211':112C,115C 'info':121C 'interfac':45B,103C,143C,166C,189C 'kernel':2A,20B,31B,88C 'linux':1A,21B,30B,87C 'lookup':107C,116C 'mac80211':22B,33B,96C 'match':47B,145C,162C 'may':179C 'meant':74B 'one':42B,76B,142C 'point':69B 'port':135C,175C 'prevent':97C 'ra':117C 'resolv':94C 'runtim':23B 'self':25B 'self-host':24B 'sent':9A,40B,140C,170C,181C 'setup':70B 'sinc':104C,177C 'sta':118C,120C 'stack':37B 'station':13A,49B,81B,106C,147C,163C,184C 'thus':144C 'traffic':73B 'transmit':60B,158C 'tx':100C 'unicast':38B,138C 'use':119C 'vlan':5A,44B,53B,77B,84B,99C,129C,151C,183C 'vulner':91C 'wi':35B 'wi-fi':34B 'wifi':3A,27B,95C 'wrong':12A","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Linux kernel as a Wi-Fi access point that uses AP VLAN interfaces are plausibly exposed, since the flaw is in how mac80211 picks the destination station for AP and AP VLAN frames. Clients, servers without Wi-Fi AP mode, and hosts without AP VLAN configuration are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98822","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}