CVE-2026-98822: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98822 is a privilege escalation vulnerability in the Linux kernel mac80211 module affecting AP VLAN transmission. This flaw allows frames to be incorrectly transmitted across VLANs within the same BSS. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-98822 Overview

CVE-2026-98822 is a Linux kernel vulnerability in the mac80211 wireless subsystem. The flaw affects AP VLAN handling, where unicast frames sent on one interface can be delivered to a station associated with a different VLAN of the same Basic Service Set (BSS). The issue was introduced when the station lookup was factored out of ieee80211_build_hdr(), causing ieee80211_lookup_ra_sta() to use sta_info_get_bss() for all AP and AP VLAN frames rather than only control port frames. The upstream fix restricts station matching to the interface the frame is sent on, with an exception for control port frames.

Critical Impact
Unicast wireless frames can leak across VLAN boundaries sharing the same BSS, breaking tenant isolation in multi-VLAN access point deployments.

Affected Products

Linux kernel mac80211 wireless subsystem
Access point deployments configured with multiple VLANs on a shared BSS
Distributions shipping affected mainline and stable kernel versions prior to the referenced fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98822 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98822

Vulnerability Analysis

The vulnerability resides in the IEEE 802.11 transmit path within the Linux kernel mac80211 driver stack. After a refactor moved station lookup out of ieee80211_build_hdr(), the helper ieee80211_lookup_ra_sta() began invoking sta_info_get_bss() for every AP and AP VLAN frame. That lookup resolves a station entry anywhere within the shared BSS, not just on the interface originating the frame.

The practical consequence is a VLAN isolation failure. When administrators segment wireless clients into separate AP VLAN netdevs tied to the same BSS, a unicast frame transmitted on VLAN A can match a station associated via VLAN B. The frame is then delivered to the wrong station, violating the tenancy boundary that AP VLAN interfaces are meant to enforce.

Control port frames are a legitimate exception. These frames carry EAPOL and related 802.1X traffic and may be sent for VLAN stations directly on the underlying BSS interface, which is why the fix retains the broader lookup for that specific case.

Root Cause

The root cause is an overly broad station lookup scope introduced during refactoring of ieee80211_build_hdr(). The use of sta_info_get_bss() for all AP VLAN unicast traffic ignored the originating sdata (sub-interface data) context, collapsing per-VLAN station tables into a single BSS-wide view.

Attack Vector

An attacker or misconfigured workload on one VLAN can receive unicast frames intended for a station on a different VLAN sharing the same BSS. The flaw does not require network-level privileges beyond association to a VLAN served by the vulnerable access point. Exploitation yields information disclosure between isolated wireless tenants and may bypass segmentation controls relied upon for guest, IoT, or multi-tenant networks.

The fix is distributed across the kernel commits 2fe08c8, 7f93ca3, 88e96d9, ad61b9a, and fd875e2. See the kernel.org stable tree commit 7f93ca3 for the authoritative patch.

Detection Methods for CVE-2026-98822

Indicators of Compromise

Wireless clients receiving unicast frames addressed to MAC addresses outside their assigned VLAN
Unexpected ARP, DHCP, or application-layer traffic appearing on isolated VLAN segments served by the same access point
Packet captures on AP VLAN interfaces showing destination MACs that do not belong to the local VLAN station table

Detection Strategies

Audit kernel versions on access points, embedded wireless appliances, and Linux-based hostapd deployments against the fixed commit hashes referenced in the kernel.org advisory links
Deploy periodic cross-VLAN probe tests from a controlled client to verify frame delivery is bounded by VLAN membership
Correlate wireless frame telemetry with VLAN-to-station mappings to surface mismatched deliveries

Monitoring Recommendations

Collect and centralize hostapd and kernel logs from access points into an aggregation platform for cross-device analysis
Monitor for new or unknown MAC addresses observed on sensitive VLANs that should contain fixed station sets
Baseline inter-VLAN broadcast and unicast volumes per AP and alert on deviations that could indicate cross-VLAN leakage

How to Mitigate CVE-2026-98822

Immediate Actions Required

Inventory all Linux-based access points and wireless controllers running mac80211 to identify unpatched kernels
Prioritize patching devices that serve multiple AP VLAN interfaces on a shared BSS, including guest and IoT segments
Where patching is deferred, consider separating sensitive tenants onto distinct BSSIDs or physical radios to eliminate shared-BSS exposure

Patch Information

Apply a Linux kernel build that includes the upstream fix. Relevant stable tree commits are 2fe08c8, 7f93ca3, 88e96d9, ad61b9a, and fd875e2. After patching, reboot or reload the wireless subsystem to ensure the fixed ieee80211_lookup_ra_sta() behavior is active.

Workarounds

Avoid configurations that place multiple AP VLAN interfaces on the same BSS when strong tenant isolation is required
Use distinct SSIDs and BSSIDs per tenant class so station lookups cannot cross a shared BSS
Enforce upstream VLAN filtering on the wired side so leaked frames do not propagate beyond the access point

bash

# Verify running kernel against fixed stable commits
uname -r

# Check hostapd configuration for shared-BSS AP VLAN usage
grep -E 'bss=|vlan_file|dynamic_vlan' /etc/hostapd/hostapd.conf