CVE-2026-98422: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98422 is a denial-of-service vulnerability in the Linux kernel's mac80211 wireless subsystem, specifically in the handling of AP_VLAN interface lifecycle management. The flaw causes the crypto_tx_tailroom_needed_cnt counter to be incremented on each AP_VLAN interface bring-up (ifup) but never decremented on bring-down (ifdown), eventually triggering a kernel sanity check (WARN_ON_ONCE). Affected versions begin at Linux kernel 4.1; fixed versions include 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4. The vulnerability was published on October 14, 2026, with a CVSS base score of 0.0 (no severity rating assigned at time of publication) and a Feedly estimate of Medium (GitHub Advisory, Feedly).

The root cause is an improper counter management issue (related to CWE-911: Improper Update of Reference Count) in the mac80211 subsystem's AP_VLAN interface handling. On ifup, an AP_VLAN interface inherits the crypto_tx_tailroom_needed_cnt value from its parent AP interface, but the counter is never reset or decremented when the AP_VLAN interface is brought down (ifdown). Repeated toggling of the AP_VLAN interface causes the counter to grow unboundedly, eventually violating the kernel's internal consistency check: WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt != master->crypto_tx_tailroom_needed_cnt). Exploitation requires local access with CAP_NET_ADMIN or root privileges to manipulate network interface state (GitHub Advisory).

Successful exploitation can destabilize or crash the Linux kernel's wireless subsystem by triggering a WARN_ON_ONCE sanity check failure, resulting in a denial-of-service condition. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The affected scope is confined to systems running Linux kernel 4.1 or later with mac80211-based wireless drivers and AP_VLAN interface configurations (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication. The vulnerability requires local access with elevated privileges (CAP_NET_ADMIN or root), significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the kernel patch that resets crypto_tx_tailroom_needed_cnt to zero on AP_VLAN ifdown. Fixed versions are available across multiple stable branches: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4. As a workaround, restrict CAP_NET_ADMIN capabilities to trusted users only to prevent unprivileged local users from toggling AP_VLAN interfaces. Update to a patched kernel version provided by your Linux distribution as soon as available (GitHub Advisory).