In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA… (CVE-2026-98707)

The vulnerability in the Linux kernel's mac80211 WiFi component concerns improper handling of RX BA session teardown. Specifically, tearing down an RX BA session can leave the session timer queued on a freed tid_rx structure. During later timer-wheel processing, the timer callback may execute against freed memory, causing use-after-free conditions. The RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and remain in a read-side critical section while teardown deletes the session timer. This stale handler can rearm the timer after timer_delete_sync() returns but before the RCU callback frees tid_rx. The remediation replaces timer_delete_sync() with timer_shutdown_sync() to ensure rearm attempts are ineffective once teardown starts, preventing use-after-free.

This vulnerability can lead to use-after-free conditions in kernel memory, potentially causing system instability or crashes. While no active exploits are known, such memory corruption issues could be leveraged for privilege escalation or denial of service if exploited.

A fix has been implemented in the Linux kernel to address this issue by using timer_shutdown_sync() during RX BA session teardown to prevent timer rearming after teardown begins. Users should apply the official kernel updates that include this fix. No additional mitigations are indicated by the vendor advisory.