All vulnerabilities
CVE-2026-98192

Linux: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15e59e377facc87ce82228279d88efaa89fdbca5Also 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd, 2bddc5d088cf430ecd913020472f1def32a36a3dCVE List
Published6 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 15e59e377facc87ce82228279d88efaa89fdbca5LinuxCVE List
  • 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bdLinuxCVE List
  • 2bddc5d088cf430ecd913020472f1def32a36a3dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe().

Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected.

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 12

  • Linuxaffected: fdf21cc3714939dd4327f3d664fe5863d15ccb31 before 15e59e377facc87ce82228279d88efaa89fdbca5CVE List
  • Linuxaffected: fdf21cc3714939dd4327f3d664fe5863d15ccb31 before 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bdCVE List
  • Linuxaffected: fdf21cc3714939dd4327f3d664fe5863d15ccb31 before 2bddc5d088cf430ecd913020472f1def32a36a3dCVE List
  • Linuxaffected: fdf21cc3714939dd4327f3d664fe5863d15ccb31 before c0df0878e9110909cf0bec6080d72d36401a0c89CVE List
  • Linuxaffected: fdf21cc3714939dd4327f3d664fe5863d15ccb31 before d9be5e75530772fc31637070d51e5717d6aeaa2aCVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5