CVE-2026-98192 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe().
Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected.
This issue was found by an in-house static analysis tool.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Linux kernel's wireless driver subsystem for Qualcomm WCN36XX devices represents a classic use-after-free condition arising from improper synchronization during resource teardown. The core of the issue lies in the implementation of wcn36xx_dxe_deinit, which is responsible for cleaning up the transmission acknowledgment timer infrastructure. Specifically, this function utilizes timer_delete to dismantle the TX ack timer mechanism. While timer_dequeue effectively removes the timer from the kernel's internal scheduling structures and prevents it from being triggered by future timeouts, it does not guarantee that a callback currently in execution will complete before the associated memory is released. This asynchronous behavior creates a race condition window where the driver proceeds with deallocation while background processing may still be active.
The operational impact of this flaw is significant as it leads to kernel instability and potential security compromises through arbitrary code execution or denial of service scenarios. The callback function, wcn36xx_dxe_tx_timer, accesses critical data structures including wcn->dxe_lock, reads the pointer wcn->tx_ack_skb, and passes wcn->hw to ieee80211_tx_status_irqsafe. These operations rely on the integrity of the wcn structure and its embedded ieee80211_hw object. However, these objects are freed during the subsequent call to wcn36xx_remove. Because free_irq only synchronizes interrupt handlers and does not wait for timer callbacks that might already be executing in softirq or tasklet context, there is no guarantee that the timer callback has finished when the memory is returned to the system allocator. Consequently, if the timer fires just before deallocation completes, it will dereference pointers to freed memory, resulting in a use-after-free vulnerability.
From a technical standards perspective, this flaw maps directly to CWE-416: Use After Free, which occurs when software uses an object after its lifetime has ended. The specific mechanism involves the failure to properly synchronize asynchronous execution contexts during cleanup routines. In terms of adversarial tactics, this type of race condition can be leveraged within the ATT&CK framework under techniques related to privilege escalation or defense evasion if exploited by a local attacker with access to network interfaces. The vulnerability highlights a common pitfall in kernel development where developers assume that dequeuing an event source is sufficient for safe cleanup without considering the latency and concurrency characteristics of timer callbacks versus interrupt handlers.
The resolution involves replacing timer_delete with timer_shutdown_sync within the teardown sequence. This function provides stronger guarantees by not only removing the timer from scheduling but also waiting for any currently executing callback to complete before returning control to the caller. Additionally, it prevents the timer from being rearmed accidentally during the shutdown phase. This change ensures that all references to wcn->dxe_lock and other associated data structures are no longer accessible when the memory is freed. The fix maintains operational continuity because the timer infrastructure is re-initialized by wcn36xx_dxe_init upon the next device start, ensuring that normal transmission acknowledgment operations remain unaffected after a restart cycle. This approach aligns with best practices for kernel resource management where explicit synchronization primitives must be used to manage concurrent access to shared resources during lifecycle transitions.