Cloudanix VulnDB

CVE-2026-98192

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in Linux Wi-Fi handling could let a local attacker crash the computer or gain extra privileges by racing hardware cleanup operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in the wcn36xx Wi-Fi driver where timer_delete() in wcn36xx_dxe_deinit() fails to wait for a running wcn36xx_dxe_tx_timer() callback, allowing it to dereference freed wcn and ieee80211_hw structures after free_irq() and wcn36xx_remove().

Why it matters to the business

Potential kernel crashes, denial of service, or local privilege escalation on Linux systems using affected Qualcomm Wi-Fi hardware; low exploitability reduces immediate risk but still requires patching in device fleets.

How an attack unfolds

An attacker with local access triggers module unload or device removal (wcn36xx_remove) during active TX operations so the timer callback executes after memory is freed, reading wcn->tx_ack_skb and calling ieee80211_tx_status_irqsafe on invalid hw.

How to fix it

Apply the upstream fix that replaces timer_delete() with timer_shutdown_sync() in wcn36xx_dxe_deinit(); rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Inspect kernel source for timer_shutdown_sync() in wcn36xx_dxe_deinit(); confirm the driver no longer calls timer_delete() and that the start/stop cycle remains intact via code review or boot tests with the patched driver.

Typical attack path

  1. Obtain local code execution on the target Linux system
  2. Trigger repeated Wi-Fi TX activity to arm the ack timer
  3. Force driver teardown via rmmod, device removal, or interface down
  4. Race the timer callback against the freed wcn structure

How to detect it

Review kernel logs for oops or use-after-free warnings referencing wcn36xx_dxe_tx_timer or wcn36xx_remove; correlate with module unload or interface removal events.

What your security team should do

  • Prioritize kernel updates containing the timer_shutdown_sync() change on all systems exposing the wcn36xx driver
  • Monitor for local privilege-escalation attempts on multi-user Linux hosts
  • Test Wi-Fi suspend/resume and interface restart cycles after patching

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed