CVE-2026-74489

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix tid_tx use-after-free on BA session stop

ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through

ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping

sta->lock:

ieee80211_remove_tid_tx(sta, tid); /* kfree_rcu(tid_tx, rcu_head) */

...

spin_unlock_bh(&sta->lock);

if (start_txq)

ieee80211_agg_start_txq(sta, tid, false);

if (send_delba)

ieee80211_send_delba(..., tid_tx->ndp);

That read is not covered by an RCU read-side critical section, and it runs

in preemptible process context: both callers hold the wiphy mutex, reaching

it either from the ieee80211_ba_session_work() wiphy work or from

ieee80211_sta_tear_down_BA_sessions() during station teardown.

Softirqs can run in that window too, both from the local_bh_enable() that

ends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU

callback can free tid_tx before the read.

Driving the function from a test

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References