Improper initialization in Linux kernel - CVE-2026-98422
Published: October 15, 2026
Vulnerability identifier: #VU155891
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98422
CWE-ID: CWE-665
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger a kernel warning.
The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.
The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98422
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/304a874670a0b6ab5589a7f60b4af0251797b121
- https://git.kernel.org/stable/c/3d76b45e8432c0d75fcb9e90d92eaa3176898adf
- https://git.kernel.org/stable/c/4504f3960dc4501c73be9f99eabda2e26e9db41e
- https://git.kernel.org/stable/c/4b54d01b48445b66c9e576de92b90a3a3ae7b34a
- https://git.kernel.org/stable/c/7775759e3cb35ef5a571b2d877c2a9b70a5d5f08
- https://git.kernel.org/stable/c/875835377d8d62c849b4eb03a7abfafa71d7668f
- https://git.kernel.org/stable/c/b0b32d3f163d24ea7134380666193bf398e9dc0b
- https://git.kernel.org/stable/c/f6b34a7d64324faf28eedc0f8678b0f832f1cc36