The hole 196 flaw consists basically in take advantage of what page 196 of the standard says... it says that messages sent with group keys, ie keys intended for broadcast communications, do not have protection against spoofing. Thus, an attacker can send a message with a GTK key with the IP that he wants.
The point of the attack is to send a message with a GTK key but directed to a target MAC instead of a broadcasting MAC address. By doing this, only the victim will process that broadcast packet and, therefore, unless the ARP table has static resolution for the MAC of the gateway, IP poisoning will occur which will allow the router to be supplanted.
Since that moment on, when the victim communicates with the Gateway, the PTK keys associated with that IP will be used, which the attacker will kindly deliver to make the MITM. Simple but functional.
It doesn't care if is a Robust Secure Network using WPA2 and AES. It can be performed anyway but with client isolation you can avoid the problem. Anyway, performance will be compromised.