CVE-2026-98422
Description
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with network administration privileges can cause a Denial of Service (DoS) by repeatedly activating and deactivating Access Point Virtual Local Area Network (AP_VLAN) interfaces. When an AP_VLAN interface is stopped, the kernel fails to reset an internal cryptographic buffer counter. Bringing the interface back up causes this counter to continuously increment, eventually triggering a kernel sanity check failure and potential system crash.
Statement
A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem. When an AP_VLAN interface is brought down, the crypto_tx_tailroom_needed_cnt counter it acquired from the master AP interface during ifup is not reset. A local user with network administration privileges (CAP_NET_ADMIN) can exploit this by repeatedly bringing an AP_VLAN interface up and down, causing the counter to increment on each cycle until it no longer matches the master interface's value and triggers the WARN_ON_ONCE sanity check in mac80211. The demonstrated impact is limited to incorrect state accounting and a kernel warning; a system crash and denial of service is possible only on systems configured to panic on warnings (for example with panic_on_warn enabled). Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), Red Hat Product Security assessed the overall impact of this flaw as low, because exploitation requires local administrative privileges and there is no confidentiality, integrity, or privilege escalation impact.
This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS-based nodes of OpenShift Container Platform 4 and 5. For these products the fix is currently deferred: the issue is a low-impact, privilege-gated kernel warning that can only be triggered by a local user who already controls network interface administration, and the residual risk is limited to a kernel warning, or a panic only on hosts where panic-on-warning is enabled and such a user repeatedly toggles AP_VLAN interfaces. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream, and Red Hat Enterprise Linux 6 is out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the assert() extends beyond the attacker's own session. For example, if a server handles multiple simultaneous connections, if an assert() occurs in one single connection that causes all other connections to be dropped, this could be a significant denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
