CVE-2026-98192: Linux kernel · wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
Source GCVE Database
Not known to be exploited · fixed in e7f265d507ee55017b67ef4722df884468be1113 : patch Linux kernel soon.
Data as of 30 Oct 2026, 17:18 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in e7f265d507ee55017b67ef4722df884468be1113, d9be5e75530772fc31637070d51e5717d6aeaa2a, c0df0878e9110909cf0bec6080d72d36401a0c89 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix has been implemented that replaces timer_delete() with timer_shutdown_sync() in the wcn36xx driver to safely teardown the TX acknowledgment timer and prevent use-after-free conditions. Users and administrators should apply the official Linux kernel updates that include this fix once available. Until patched, caution is advised when using affected WiFi hardware with the vulnerable driver version.
Description
A use-after-free vulnerability was identified and fixed in the Linux kernel's wcn36xx WiFi driver related to the teardown of the TX acknowledgment timer. The issue arises because timer_delete() does not wait for a running timer callback to complete, potentially allowing the callback to access freed memory. The fix replaces timer_delete() with timer_shutdown_sync(), which waits for any running callbacks to finish before proceeding, preventing use-after-free conditions.
References
- nvd.nist.gov/vuln/detail/CVE-2026-98192 (opens in a new tab)
- git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5 (opens in a new tab)
- git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d (opens in a new tab)
- git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd (opens in a new tab)
- git.kernel.org/stable/c/7ce1e55a439968a298a63d3199cb1c2636429746 (opens in a new tab)
- git.kernel.org/stable/c/915298dbb766d2311b0822ab6ef24780def0bd53 (opens in a new tab)
- git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89 (opens in a new tab)
- git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a (opens in a new tab)
- git.kernel.org/stable/c/e7f265d507ee55017b67ef4722df884468be1113 (opens in a new tab)