wifi: mac80211: shut down RX BA session timer on teardown

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98707
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:24 UTC
Updated2026-10-19 10:19:35 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory. An RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer_delete_sync() returns and before the RCU callback frees tid_rx. Use timer_shutdown_sync() so rearm attempts become ineffective once teardown starts. Keep reorder_timer unchanged: teardown marks the session removed under reorder_lock and its release path checks that state before rearming. session_timer has no equivalent guard because ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected a87f736d942c86255e3088c606f0e3eab6bbf784 7bb2a5bd4f07192fca35644fab7d49a17bfbc861 git Not specified
CNA Linux Linux affected a87f736d942c86255e3088c606f0e3eab6bbf784 481f9230284c27052b59c587069f232c5d84779e git Not specified
CNA Linux Linux affected a87f736d942c86255e3088c606f0e3eab6bbf784 09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba git Not specified
CNA Linux Linux affected a87f736d942c86255e3088c606f0e3eab6bbf784 e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e git Not specified
CNA Linux Linux affected 2.6.36 Not specified
CNA Linux Linux unaffected 2.6.36 semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.56 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.10 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/481f9230284c27052b59c587069f232c5d84779e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7bb2a5bd4f07192fca35644fab7d49a17bfbc861 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report