CVE-2026-98822: wifi: mac80211: prevent AP VLAN tx from other interfaces
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: prevent AP VLAN tx from other interfaces
Since the station lookup was factored out of ieee80211buildhdr(), ieee80211lookuprasta() uses stainfogetbss() for all AP and AP VLAN frames, not only for control port frames. A unicast frame sent on one interface thus matches a station of a different VLAN of the same BSS and is transmitted to it.
Only match stations of the interface the frame is sent on, except for control port frames, since those may be sent for VLAN stations directly on the BSS interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Linux kernel mac80211 deployments using an AP with VLAN interfaces in the same BSS. It concerns unicast traffic sent through one interface that can match a station associated with a different VLAN.
What conditions are needed for unintended traffic delivery?
A unicast frame must be sent on one AP or AP VLAN interface while a matching station exists on a different VLAN of the same BSS. The incorrect station lookup can then select that station and transmit the frame to it.
Are control-port frames subject to the same interface restriction?
No. Control-port frames are intentionally allowed to match VLAN stations directly from the BSS interface, because such frames may need to be sent that way.
What does the fix change?
The fix restricts station matching to the interface on which the frame is sent for AP and AP VLAN traffic. It preserves the exception for control-port frames.