Cloudanix VulnDB

CVE-2026-98707

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain WiFi network sessions can cause computers to crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mac80211 RX BA session teardown where a timer remains queued against freed tid_rx memory; RCU-protected handlers and rearm logic can access or reactivate the timer after timer_delete_sync but before RCU grace period completes.

Why it matters to the business

Kernel crashes or memory corruption on Linux WiFi systems can produce denial of service, loss of network connectivity, and potential for further exploitation in high-availability or embedded deployments.

How an attack unfolds

An attacker transmits crafted 802.11 frames that cause RX BA session establishment followed by rapid teardown; this leaves the session_timer active so that a stale handler can rearm it after deletion, resulting in callback execution against freed memory.

How to fix it

Apply the upstream fix that replaces timer_delete_sync with timer_shutdown_sync on the session_timer; rebuild and deploy the patched kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm the presence of timer_shutdown_sync in the RX BA teardown path and verify that reorder_timer remains protected by reorder_lock state checks; test session creation/teardown under load.

Typical attack path

  1. Send 802.11 frames to establish an RX BA session
  2. Force or race session teardown while RCU read-side critical sections remain active
  3. Trigger timer-wheel processing or handler rearm after timer_delete_sync returns
  4. Execute arbitrary or crashing code via the freed tid_rx object

How to detect it

Inspect kernel logs (dmesg, journalctl) for oops/panic traces mentioning mac80211, tid_rx, session_timer, or ieee80211_rx_h_ctrl; correlate with sudden WiFi interface resets.

What your security team should do

  • Prioritize kernel updates on all WiFi-enabled Linux hosts within the next maintenance window
  • Enable kernel panic and oops logging to detect exploitation attempts
  • Review wireless driver configuration for unnecessary BA session features if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory. An RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer_delete_sync() returns and before the RCU callback frees tid_rx. Use timer_shutdown_sync() so rearm attempts become ineffective once teardown starts. Keep reorder_timer unchanged: teardown marks the session removed under reorder_lock and its release path checks that state before rearming. session_timer has no equivalent guard because ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.

Affected packages

Ecosystem Package Introduced Fixed