Skip to main content
VulnerabilityPublished Updated

CVE-2026-98192: Linux kernel · wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

Source GCVE Database

0
Compare
Authoritative record:CVE-2026-98192· High

Not known to be exploited · fixed in e7f265d507ee55017b67ef4722df884468be1113 : patch Linux kernel soon.

Data as of 30 Oct 2026, 17:18 UTC

Severity
High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none
Patch
Available – fixed in e7f265d507ee55017b67ef4722df884468be1113, d9be5e75530772fc31637070d51e5717d6aeaa2a, c0df0878e9110909cf0bec6080d72d36401a0c89 +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 6 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < e7f265d507ee55017b67ef4722df884468be1113
Fixed in
  • e7f265d507ee55017b67ef4722df884468be1113
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < d9be5e75530772fc31637070d51e5717d6aeaa2a
Fixed in
  • d9be5e75530772fc31637070d51e5717d6aeaa2a
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < c0df0878e9110909cf0bec6080d72d36401a0c89
Fixed in
  • c0df0878e9110909cf0bec6080d72d36401a0c89
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < 915298dbb766d2311b0822ab6ef24780def0bd53
Fixed in
  • 915298dbb766d2311b0822ab6ef24780def0bd53
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < 15e59e377facc87ce82228279d88efaa89fdbca5
Fixed in
  • 15e59e377facc87ce82228279d88efaa89fdbca5
LinuxLinuxAffected
  • ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < 7ce1e55a439968a298a63d3199cb1c2636429746
Fixed in
  • 7ce1e55a439968a298a63d3199cb1c2636429746

AI-suggested

A fix has been implemented that replaces timer_delete() with timer_shutdown_sync() in the wcn36xx driver to safely teardown the TX acknowledgment timer and prevent use-after-free conditions. Users and administrators should apply the official Linux kernel updates that include this fix once available. Until patched, caution is advised when using affected WiFi hardware with the vulnerable driver version.

Description

A use-after-free vulnerability was identified and fixed in the Linux kernel's wcn36xx WiFi driver related to the teardown of the TX acknowledgment timer. The issue arises because timer_delete() does not wait for a running timer callback to complete, potentially allowing the callback to access freed memory. The fix replaces timer_delete() with timer_shutdown_sync(), which waits for any running callbacks to finish before proceeding, preventing use-after-free conditions.

References

Community reviews

Loading reviews…