CVE-2026-98707 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: shut down RX BA session timer on teardown
Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory.
An RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer_delete_sync() returns and before the RCU callback frees tid_rx.
Use timer_shutdown_sync() so rearm attempts become ineffective once teardown starts. Keep reorder_timer unchanged: teardown marks the session removed under reorder_lock and its release path checks that state before rearming. session_timer has no equivalent guard because ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the Linux kernel within the mac80211 wireless subsystem represents a critical use-after-free condition arising from improper synchronization during the teardown of Receive Block Acknowledgment sessions. This flaw specifically affects the handling of RX BA session timers, where the lifecycle management of timer structures fails to align with the memory deallocation of associated data structures. When an RX BA session is torn down, the system may leave a session timer queued on a tid_rx structure that has already been freed from memory. Consequently, when the kernel's timer-wheel processing mechanism executes or when the specific timer callback runs, it attempts to access and manipulate memory locations that are no longer valid, leading to undefined behavior, potential kernel panics, or arbitrary code execution depending on how the freed memory is subsequently utilized by other system processes.
The technical root cause lies in a race condition involving RCU read-side critical sections and timer rearming operations. Specifically, an RX BAR handler may dereference the tid_rx structure under RCU protection before the teardown process has fully unpublished it from the active state. This allows the stale handler to remain within its read-side critical section even as the teardown logic proceeds to delete the session timer using standard deletion functions. The vulnerability is exacerbated because the stale handler can rearm the timer after timer_delete_sync returns but before the RCU callback completes and actually frees the tid_rx memory. This window of time creates a scenario where a pointer to freed memory remains active in the kernel's scheduling infrastructure, allowing subsequent execution contexts to interact with invalid addresses.
From an operational impact perspective, this vulnerability can lead to severe stability issues within the wireless networking stack. The dereferencing of freed memory typically results in kernel oops or full system crashes, disrupting network connectivity and potentially causing denial-of-service conditions for local users or services relying on Wi-Fi functionality. In more sophisticated attack scenarios where an attacker can influence the content written into the freed tid_rx structure through heap spraying techniques, this use-after-free condition could be exploited to achieve arbitrary code execution with kernel privileges. This elevates a local vulnerability to one that compromises the entire system's integrity and confidentiality, as kernel-level access bypasses all user-space security controls.
To mitigate this risk, the resolution involves modifying the timer shutdown logic within the mac80211 subsystem by utilizing timer_shutdown_sync instead of standard deletion methods. The use of timer_shutdown_sync ensures that any attempts to rearm the timer become ineffective immediately once the teardown process begins, thereby preventing stale handlers from scheduling callbacks against freed memory structures. Additionally, the implementation retains the existing guard for the reorder_timer, which relies on marking the session as removed under a lock before checking this state during release paths. However, because the session_timer lacks an equivalent synchronization guard due to how ieee80211_rx_h_ctrl rearms it prior to acquiring locks, the shift to timer_shutdown_sync provides the necessary atomicity and safety guarantees to close this race condition entirely.
This vulnerability aligns with CWE-416, Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to unpredictable behavior or security vulnerabilities. Furthermore, from an offensive security perspective, such flaws are often leveraged in the ATT&CK framework under techniques related to Privilege Escalation and Defense Evasion, as gaining kernel-level code execution allows attackers to bypass standard operating system protections. The fix emphasizes the importance of rigorous synchronization primitives when managing resources that have asynchronous lifecycles involving timers and RCU mechanisms, ensuring that resource deallocation is strictly sequenced after all potential access points are safely closed or invalidated.