All vulnerabilities
CVE-2026-98707

Linux: wifi: mac80211: shut down RX BA session timer on teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7bb2a5bd4f07192fca35644fab7d49a17bfbc861Also 481f9230284c27052b59c587069f232c5d84779e, 09b7d5e4f88504e62ddf4ff31ebeebb3b87578baCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 7bb2a5bd4f07192fca35644fab7d49a17bfbc861LinuxCVE List
  • 481f9230284c27052b59c587069f232c5d84779eLinuxCVE List
  • 09b7d5e4f88504e62ddf4ff31ebeebb3b87578baLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: shut down RX BA session timer on teardown

Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory.

An RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer_delete_sync() returns and before the RCU callback frees tid_rx.

Use timer_shutdown_sync() so rearm attempts become ineffective once teardown starts. Keep reorder_timer unchanged: teardown marks the session removed under reorder_lock and its release path checks that state before rearming. session_timer has no equivalent guard because ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.

Text from CVE List

Affected versions 12

  • Linuxaffected: a87f736d942c86255e3088c606f0e3eab6bbf784 before d0da6ab1fc53a68025929baf0947519c6c1684dcCVE List
  • Linuxaffected: a87f736d942c86255e3088c606f0e3eab6bbf784 before 7bb2a5bd4f07192fca35644fab7d49a17bfbc861CVE List
  • Linuxaffected: a87f736d942c86255e3088c606f0e3eab6bbf784 before 481f9230284c27052b59c587069f232c5d84779eCVE List
  • Linuxaffected: a87f736d942c86255e3088c606f0e3eab6bbf784 before 09b7d5e4f88504e62ddf4ff31ebeebb3b87578baCVE List
  • Linuxaffected: a87f736d942c86255e3088c606f0e3eab6bbf784 before e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598eCVE List
  • Linuxaffected: 2.6.36CVE List
  • Linuxunaffected: all versions before 2.6.36CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5