CVE-2026-98336

What it actually does

The vulnerability stems from mac80211 attempting to offload traffic control (TC) setup to drivers on AP_VLAN interfaces, which are virtual and unsupported for offload; this improper input validation allows invalid offload requests to reach drivers, potentially causing failures in software fallback or driver state corruption.

Why it matters to the business

Wireless access point configurations using VLANs on Linux systems may experience network instability or degraded performance until the kernel is updated, with low immediate risk given stable low exploit probability and no known active campaigns.

How an attack unfolds

An attacker with local or network access to a vulnerable Linux Wi-Fi setup configures traffic control rules targeting an AP_VLAN interface, triggering the kernel to attempt driver offload of the TC setup; because the interface is virtual, the offload fails or behaves unexpectedly, leading to denial of service or unexpected software path execution.

How to fix it

Update the Linux kernel to a version containing the fix that rejects TC offload requests on AP_VLAN interfaces; apply the patch from the mac80211 component and rebuild or deploy the updated kernel package.

How to confirm the fix worked

Confirm the fix by verifying the kernel source contains the check that returns an error for TC offload on AP_VLAN interfaces; test by attempting TC setup on such an interface and confirming it is rejected and handled in software without driver involvement.

Typical attack path

1. Identify a target Linux system running a vulnerable mac80211 kernel with AP_VLAN interfaces configured.
2. Create or manipulate traffic control (TC) rules that reference the AP_VLAN interface.
3. Trigger the offload attempt by activating the interface or applying the rules.
4. Observe or exploit resulting driver or kernel behavior from the invalid offload request.

How to detect it

Review kernel logs for messages related to TC offload attempts on virtual wireless interfaces or errors from mac80211 when AP_VLAN interfaces are active; look for unexpected software fallback paths or driver complaints during interface configuration.

What your security team should do

• Prioritize kernel updates for systems using mac80211 with VLAN wireless configurations.
• Monitor upstream Linux kernel changelogs for mac80211 fixes and schedule testing in lab environments.
• Review wireless AP configurations to minimize reliance on virtual interfaces where possible until patched.