In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or… (CVE-2026-98706)

The vulnerability in the Linux kernel's mac80211 WiFi component concerns the handling of power-save delivery work during the teardown of a station (AP or mesh station). Specifically, the function sta_deliver_ps_frames() checks if a station is dead only before starting delivery, but a delayed worker can resume after the station is marked dead and removed from the driver, causing it to continue delivery improperly. The original cleanup process canceled work too late, after driver state changes and queue purging, allowing a window where the worker could operate on invalid state. The fix cancels the work immediately after setting the station dead and before changing driver state, closing this window and ensuring proper synchronization of work cancellation during station removal.

This vulnerability could lead to inconsistent driver state or unexpected behavior in the WiFi subsystem during station removal due to race conditions in power-save frame delivery work. No direct exploitation details or impacts such as privilege escalation or denial of service are provided. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel to reorder work cancellation during station teardown, ensuring proper synchronization and preventing the race condition. Users should update to the fixed Linux kernel version containing this patch. Patch status is not explicitly stated; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.