CVE-2026-98422

What it actually does

The mac80211 subsystem fails to decrement the crypto_tx_tailroom_needed_cnt counter for AP_VLAN interfaces on interface down events, causing desynchronization from the master AP interface and triggering a kernel sanity check warning on subsequent up operations.

Why it matters to the business

Linux systems running wireless access points with VLAN interfaces may encounter repeated kernel warnings or degraded stability during routine interface management, potentially disrupting network services in affected environments.

How an attack unfolds

An attacker with the ability to manage network interfaces repeatedly brings an AP_VLAN interface up and down without also cycling the parent AP, incrementing the counter until the sanity check fires and produces kernel warnings.

How to fix it

Apply a kernel update or backport that resets the AP_VLAN crypto_tx_tailroom_needed_cnt on ifdown events.

How to confirm the fix worked

Confirm the presence of the reset logic for the AP_VLAN tailroom counter during ifdown in the running kernel source or binary, and test repeated ifup/ifdown cycles without triggering the warning.

Typical attack path

1. Obtain local access or interface management privileges on a Linux system using mac80211 AP_VLAN
2. Bring the AP_VLAN interface up to copy the counter value
3. Bring the AP_VLAN interface down without cycling the parent AP
4. Repeat the up/down cycle to drive counter mismatch
5. Trigger the WARN_ON_ONCE sanity check

How to detect it

Search kernel logs and dmesg for the WARN_ON_ONCE message referencing crypto_tx_tailroom_needed_cnt mismatch between sdata and master interfaces.

What your security team should do

• Prioritize kernel updates for systems exposing mac80211 AP_VLAN interfaces
• Monitor kernel logs for crypto_tx_tailroom_needed_cnt warnings
• Limit unnecessary AP_VLAN interface cycling in production configurations