CVE-2026-98336
Description
A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. A local user with network administration privileges can cause a denial of service (DoS) by configuring hardware traffic control (TC) offloading on virtual Access Point Virtual Local Area Network (AP_VLAN) interfaces. Because these interfaces are purely virtual and lack hardware driver support, attempting to offload traffic control operations causes system instability and crashes the kernel.
Statement
A flaw in the Linux kernel's mac80211 wireless networking subsystem allows a local user with network administration privileges (CAP_NET_ADMIN) to cause a denial of service, and Red Hat has rated this flaw as having MODERATE impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). When traffic control (TC) offload is configured on a purely virtual AP_VLAN interface, mac80211 forwards the offload setup request to the wireless driver even though such interfaces have no hardware backing, which can destabilize or crash the kernel. The issue affects availability only; there is no impact on confidentiality or integrity.
The functionality that introduced this flaw first appeared in RHEL 9.3, so Red Hat Enterprise Linux 9 update streams from 9.4 onward, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9 are affected. Red Hat Enterprise Linux 8 and earlier releases (including their kernel-rt variants), RHEL 9.2, and older OpenShift Container Platform streams are not affected because the vulnerable code is not present in those releases. RHEL 6 Extended Lifecycle Support is out of support scope.
The fix is currently deferred for the affected streams. Exploitation requires local access with network administration privileges, and the impact is limited to a kernel crash (denial of service), so the residual risk of deferring the fix is limited to system availability; a privileged local attacker could still disrupt the system by triggering the crash.
Mitigation
As a workaround, avoid configuring traffic control (TC) offload on AP_VLAN interfaces. AP_VLAN interfaces are purely virtual and have no hardware backing; traffic control on them is processed in software, and refraining from requesting TC offload on these interfaces prevents the unsupported offload request from being passed to the wireless driver and avoids the resulting kernel crash. Apart from applying this workaround until a fix is delivered in a future kernel update, no other mitigation is currently available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
