In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station… (CVE-2026-98822)

The Linux kernel's mac80211 WiFi component had a vulnerability where, after refactoring the station lookup logic, ieee80211_lookup_ra_sta() used sta_info_get_bss() for all AP and AP VLAN frames rather than only control port frames. This caused unicast frames sent on one interface to match stations belonging to different VLANs of the same BSS, resulting in unintended transmission across VLAN boundaries. The vulnerability was resolved by ensuring that only stations on the same interface as the frame's transmission are matched, except for control port frames which are allowed to be sent for VLAN stations directly on the BSS interface.

The vulnerability could lead to unicast WiFi frames being transmitted to stations on different VLANs within the same BSS, potentially causing unintended data leakage or cross-VLAN communication. This breaks VLAN isolation at the WiFi MAC layer, which could undermine network segmentation and security policies relying on VLAN separation.

A fix has been implemented in the Linux kernel to restrict station matching to the interface the frame is sent on, except for control port frames. Users should apply the official Linux kernel update that includes this fix to remediate the vulnerability. No additional mitigation steps are indicated.