---
id: "CVE-2026-98822"
kind: "vulnerability"
aliases: ["CVE-2026-98822"]
title: "Linux kernel: wifi AP VLAN frames can be sent to the wrong station"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "mac80211", "runtime", "self-hosted", "wifi"]
not_affected_if: ["no-ap-vlan", "no-wifi-access-point"]
published_at: "2026-10-18T16:17:36+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:14:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98822", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: wifi AP VLAN frames can be sent to the wrong station

In the Linux kernel's mac80211 Wi-Fi stack, unicast frames sent on one AP VLAN interface could match a station on a different VLAN of the same BSS and be transmitted to it. An attacker on the affected access point setup could get traffic meant for one VLAN delivered to a station in another VLAN.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.
- Check whether the host runs a Wi-Fi access point with AP VLAN interfaces (for example with `hostapd` and `iw dev`, looking for `AP/VLAN` type interfaces).

## Fix

- Update the Linux kernel to a build that includes the mac80211 commit 'prevent AP VLAN tx from other interfaces' (version unknown from the sources; check the NVD or distribution advisory).

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98822

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: prevent AP VLAN tx from other interfaces

Since the station lookup was factored out of ieee80211_build_hdr(),
ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN
frames, not only for control port frames. A unicast frame sent on one
interface thus matches a station of a different VLAN of the same BSS and
is transmitted to it.

Only match stations of the interface the frame is sent on, except for
control port frames, since those may be sent for VLAN stations directly
on the BSS interface.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_