{"id":"CVE-2026-98422","summary":"wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the AP_VLAN tailroom counter on ifdown\n\nOn ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from\nthe AP interface, but it's never decremented again unless the AP is\nalso brought down. Thus, bringing the same AP_VLAN up again will\nincrement the counter again and eventually hit the sanity check:\n\n  WARN_ON_ONCE(sdata-\u003ecrypto_tx_tailroom_needed_cnt !=\n               master-\u003ecrypto_tx_tailroom_needed_cnt);\n\nReset it on ifdown to avoid that.","modified":"2026-10-15T02:47:42.427179612Z","published":"2026-10-14T13:27:50.789Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98422.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/304a874670a0b6ab5589a7f60b4af0251797b121"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3d76b45e8432c0d75fcb9e90d92eaa3176898adf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4504f3960dc4501c73be9f99eabda2e26e9db41e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b54d01b48445b66c9e576de92b90a3a3ae7b34a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7775759e3cb35ef5a571b2d877c2a9b70a5d5f08"},{"type":"WEB","url":"https://git.kernel.org/stable/c/875835377d8d62c849b4eb03a7abfafa71d7668f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b0b32d3f163d24ea7134380666193bf398e9dc0b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f6b34a7d64324faf28eedc0f8678b0f832f1cc36"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98422.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98422"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f9dca80b98caac8b4bfb43a2edf1e9f877ccf322"},{"fixed":"b0b32d3f163d24ea7134380666193bf398e9dc0b"},{"fixed":"f6b34a7d64324faf28eedc0f8678b0f832f1cc36"},{"fixed":"304a874670a0b6ab5589a7f60b4af0251797b121"},{"fixed":"7775759e3cb35ef5a571b2d877c2a9b70a5d5f08"},{"fixed":"3d76b45e8432c0d75fcb9e90d92eaa3176898adf"},{"fixed":"4b54d01b48445b66c9e576de92b90a3a3ae7b34a"},{"fixed":"875835377d8d62c849b4eb03a7abfafa71d7668f"},{"fixed":"4504f3960dc4501c73be9f99eabda2e26e9db41e"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98422.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.112"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.54"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98422.json"}}],"schema_version":"1.9.0"}