CVE-2026-98707

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: shut down RX BA session timer on teardown

Tearing down an RX BA session can leave the session timer queued on a

freed tid_rx. Later timer-wheel processing and the timer callback itself

then run against freed memory.

An RX BAR handler can dereference tid_rx under RCU before teardown

unpublishes it and stay in its read-side critical section while teardown

deletes the session timer. The stale handler can then rearm the timer

after timer_delete_sync() returns and before the RCU callback frees

tid_rx.

Use timer_shutdown_sync() so rearm attempts become ineffective once

teardown starts. Keep reorder_timer unchanged: teardown marks the session

removed under reorder_lock and its release path checks that state before

rearming. session_timer has no equivalent guard because

ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References