CVE-2026-98336 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
AP_VLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and it could technically even change.
Just reject the TC offload so things get done in software.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified within the mac80211 subsystem involves an improper handling of Traffic Control (TC) setup operations on AP_VLAN interfaces. These virtual network interfaces are created dynamically to support VLAN tagging over wireless networks, but they do not represent physical hardware endpoints capable of performing low-level packet processing or offloading tasks. The core technical flaw lies in the kernel's attempt to delegate TC configuration responsibilities to underlying device drivers for these specific virtual interfaces. Since AP_VLAN interfaces lack a direct mapping to fixed hardware resources that support such offloads, attempting to push this workload to driver code leads to undefined behavior, potential crashes, or incorrect packet handling because the necessary hardware context is absent.
This misconfiguration stems from an architectural oversight where the kernel does not sufficiently distinguish between physical network devices and virtual abstractions when determining offload capabilities. The AP interface itself cannot be reliably used as a fallback target for TC setup either, primarily due to dynamic topology changes in wireless networks where the association between VLANs and access points may shift or remain unknown at certain stages of operation. Consequently, forcing hardware offloads on these volatile constructs results in operational instability. By rejecting the TC offload request for AP_VLAN interfaces, the system ensures that traffic classification and queuing are handled entirely within the software stack, which is both safe and functionally correct given the virtual nature of the interface.
The operational impact of this vulnerability includes potential kernel panics or network subsystem instabilities when applications attempt to configure traffic control rules on wireless VLAN interfaces. In production environments, this could lead to service disruptions for devices relying on these specific configurations, particularly in complex enterprise Wi-Fi setups where dynamic VLAN assignment is common. The lack of proper validation allows malformed or inappropriate offload requests to propagate deeper into the driver layer, potentially causing resource leaks or state corruption within the network stack.
To mitigate this issue, it is essential that system administrators and developers ensure their Linux kernels are updated with patches addressing mac80211 TC handling logic. From a defensive perspective, implementing strict validation checks in custom kernel modules to verify interface types before issuing offload commands can prevent similar issues. Furthermore, relying on standard software-based traffic control mechanisms for virtual interfaces aligns with best practices defined by the Common Weakness Enumeration (CWE) under categories such as CWE-20 Improper Input Validation and CWE-476 NULL Pointer Dereference if null checks fail during driver interaction. This approach also mitigates risks associated with ATT&CK technique T1583, which covers acquisition of infrastructure capabilities, by ensuring that virtualized network resources are not exploited to manipulate underlying hardware states in unintended ways.