CVE-2026-98422: wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset the APVLAN tailroom counter on ifdown
On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the same APVLAN up again will increment the counter again and eventually hit the sanity check:
WARNONONCE(sdata->cryptotxtailroomneededcnt != master->cryptotxtailroomneededcnt);
Reset it on ifdown to avoid that.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mac80211 Wi-Fi stack with AP_VLAN interfaces are affected when an AP_VLAN interface is brought down and up again while its master AP remains up.
What action triggers the problem?
Repeatedly cycling the same AP_VLAN interface down and back up causes its crypto transmit tailroom counter to be incremented again without being decremented. Over time, this can trigger a WARN_ON_ONCE sanity check when the AP_VLAN counter no longer matches the master AP counter.
Is an AP_VLAN configuration required?
Yes. The issue concerns AP_VLAN interfaces; the described counter mismatch occurs during their interface-up and interface-down handling.
What is the mitigation if an update cannot be applied immediately?
Avoid repeatedly bringing AP_VLAN interfaces down and back up while leaving the master AP interface running. Bringing down the AP as well causes the counter to be decremented according to the vulnerability description.