Cloudanix VulnDB

CVE-2026-98822

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux WiFi handling could allow wireless messages meant for one set of devices to reach another set that should stay separate.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in station lookup for AP and AP VLAN frames allows unicast frames sent on one interface to match and be transmitted to stations on a different VLAN within the same BSS.

Why it matters to the business

Attackers could potentially send data to unauthorized wireless clients on different VLANs, leading to information leakage or unauthorized access in segmented networks.

How an attack unfolds

An attacker with access to one AP interface crafts unicast frames that exploit the incorrect station lookup to reach stations on another VLAN.

How to fix it

Update the Linux kernel to a version containing the mac80211 fix that restricts station matching to the sending interface for non-control-port frames.

How to confirm the fix worked

Confirm the patched kernel source applies interface-specific station lookup except for control port frames; test frame delivery isolation across VLANs.

Typical attack path

  1. Identify AP with multiple VLANs configured
  2. Send unicast frame from one interface targeting a station on another VLAN
  3. Frame incorrectly matches station via shared BSS lookup
  4. Frame is transmitted to unintended recipient station

How to detect it

Review mac80211 kernel logs and wireless driver traces for unexpected station matches or frame forwarding; inspect network captures for unicast frames crossing VLAN boundaries on the same BSS.

What your security team should do

  • Apply the kernel patch to all affected systems as soon as available
  • Review and audit WiFi AP VLAN configurations for proper isolation
  • Monitor kernel and network logs for anomalous cross-VLAN traffic

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211_build_hdr(), ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN frames, not only for control port frames. A unicast frame sent on one interface thus matches a station of a different VLAN of the same BSS and is transmitted to it. Only match stations of the interface the frame is sent on, except for control port frames, since those may be sent for VLAN stations directly on the BSS interface.

Affected packages

Ecosystem Package Introduced Fixed