CVE-2026-98336

A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. A local user with network administration privileges can cause a denial of service (DoS) by configuring hardware traffic control (TC) offloading on virtual Access Point Virtual Local Area Network (AP_VLAN) interfaces. Because these interfaces are purely virtual and lack hardware driver support, attempting to offload traffic control operations causes system instability and crashes the kernel.

A flaw in the Linux kernel's mac80211 wireless networking subsystem allows a local user with network administration privileges (CAP_NET_ADMIN) to cause a denial of service, and Red Hat has rated this flaw as having MODERATE impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). When traffic control (TC) offload is configured on a purely virtual AP_VLAN interface, mac80211 forwards the offload setup request to the wireless driver even though such interfaces have no hardware backing, which can destabilize or crash the kernel. The issue affects availability only; there is no impact on confidentiality or integrity.

The functionality that introduced this flaw first appeared in RHEL 9.3, so Red Hat Enterprise Linux 9 update streams from 9.4 onward, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9 are affected. Red Hat Enterprise Linux 8 and earlier releases (including their kernel-rt variants), RHEL 9.2, and older OpenShift Container Platform streams are not affected because the vulnerable code is not present in those releases. RHEL 6 Extended Lifecycle Support is out of support scope.

The fix is currently deferred for the affected streams. Exploitation requires local access with network administration privileges, and the impact is limited to a kernel crash (denial of service), so the residual risk of deferring the fix is limited to system availability; a privileged local attacker could still disrupt the system by triggering the crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a workaround, avoid configuring traffic control (TC) offload on AP_VLAN interfaces. AP_VLAN interfaces are purely virtual and have no hardware backing; traffic control on them is processed in software, and refraining from requesting TC offload on these interfaces prevents the unsupported offload request from being passed to the wireless driver and avoids the resulting kernel crash. Apart from applying this workaround until a fix is delivered in a future kernel update, no other mitigation is currently available.