wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
Summary
| CVE | CVE-2026-98422 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-14 14:17:53 UTC |
|---|
| Updated | 2026-10-19 10:18:47 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
On ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from
the AP interface, but it's never decremented again unless the AP is
also brought down. Thus, bringing the same AP_VLAN up again will
increment the counter again and eventually hit the sanity check:
WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt !=
master->crypto_tx_tailroom_needed_cnt);
Reset it on ifdown to avoid that. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 b0b32d3f163d24ea7134380666193bf398e9dc0b git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 f6b34a7d64324faf28eedc0f8678b0f832f1cc36 git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 304a874670a0b6ab5589a7f60b4af0251797b121 git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 7775759e3cb35ef5a571b2d877c2a9b70a5d5f08 git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 3d76b45e8432c0d75fcb9e90d92eaa3176898adf git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 4b54d01b48445b66c9e576de92b90a3a3ae7b34a git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 875835377d8d62c849b4eb03a7abfafa71d7668f git |
Not specified |
| CNA |
Linux |
Linux |
affected f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 4504f3960dc4501c73be9f99eabda2e26e9db41e git |
Not specified |
| CNA |
Linux |
Linux |
affected 4.1 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 4.1 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.10.271 5.10.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.222 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.189 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.158 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.112 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.54 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.8 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/b0b32d3f163d24ea7134380666193bf398e9dc0b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/4504f3960dc4501c73be9f99eabda2e26e9db41e |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/304a874670a0b6ab5589a7f60b4af0251797b121 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f6b34a7d64324faf28eedc0f8678b0f832f1cc36 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/4b54d01b48445b66c9e576de92b90a3a3ae7b34a |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/3d76b45e8432c0d75fcb9e90d92eaa3176898adf |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/7775759e3cb35ef5a571b2d877c2a9b70a5d5f08 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/875835377d8d62c849b4eb03a7abfafa71d7668f |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.