Improper input validation in Linux kernel - CVE-2026-98336
Published: October 15, 2026
Vulnerability identifier: #VU155938
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98336
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.
The vulnerability exists due to insufficient validation of interface types in ieee80211_netdev_setup_tc() in mac80211 when configuring traffic control offloading on AP_VLAN interfaces. A local user can request traffic control offloading on an AP_VLAN interface to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98336
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/362bd5bce29ed0f6fd3d39a7065567777d70606e
- https://git.kernel.org/stable/c/40bc8a268c3b6e21fa3a8dd1b4fd85aa905b9718
- https://git.kernel.org/stable/c/790221efbfece13a2347563b3785aaca48f192e2
- https://git.kernel.org/stable/c/9c34f01b8f2177dd4e1ee524ca1f9ca3fcd85a11
- https://git.kernel.org/stable/c/ea3ef2165e4751df2ee3bc1c07a192243a08faa5