{"id":"CVE-2026-98707","kind":"vulnerability","aliases":["CVE-2026-98707"],"related":[],"title":"Linux kernel: Wi-Fi block-ack timer can fire after session teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: shut down RX BA session timer on teardown\n\nTearing down an RX BA session can leave the session timer queued on a\nfreed tid_rx. Later timer-wheel processing and the timer callback itself\nthen run against freed memory.\n\nAn RX BAR handler can dereference tid_rx under RCU before teardown\nunpublishes it and stay in its read-side critical section while teardown\ndeletes the session timer. The stale handler can then rearm the timer\nafter timer_delete_sync() returns and before the RCU callback frees\ntid_rx.\n\nUse timer_shutdown_sync() so rearm attempts become ineffective once\nteardown starts. Keep reorder_timer unchanged: teardown marks the session\nremoved under reorder_lock and its release path checks that state before\nrearming. session_timer has no equivalent guard because\nieee80211_rx_h_ctrl() rearms it before taking reorder_lock.","summary":"In the Linux kernel's mac80211 Wi-Fi stack, the receive block-ack session timer can stay queued after the session's memory is freed, and a stale handler can rearm it. The sources do not say what an attacker gets beyond a use-after-free in kernel memory, which typically means a crash or possible code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mac80211","wifi"],"not_affected_if":["no-wifi-hardware"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the upstream kernel git history for CVE-2026-98707.\n- Check whether the mac80211 Wi-Fi stack is in use with `lsmod | grep mac80211`.\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'wifi: mac80211: shut down RX BA session timer on teardown'; the sources do not give a version number.\n- unknown","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:49+00:00","updated_at":"2026-10-25T05:18:49+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:18:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'wifi: mac80211: shut down RX BA session timer on teardown'; the sources do not give a version number.\n- unknown","reach":"unknown","title":"Linux kernel: Wi-Fi block-ack timer can fire after session teardown","impact":"high","summary":"In the Linux kernel's mac80211 Wi-Fi stack, the receive block-ack session timer can stay queued after the session's memory is freed, and a stale handler can rearm it. The sources do not say what an attacker gets beyond a use-after-free in kernel memory, which typically means a crash or possible code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","mac80211"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel use-after-free could crash the machine or run attacker code","analyst_note":"Check the NVD entry and the linked kernel.org stable commit for the fixed kernel versions and the exact trigger conditions over the air.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the upstream kernel git history for CVE-2026-98707.\n- Check whether the mac80211 Wi-Fi stack is in use with `lsmod | grep mac80211`.\n- unknown","needs_analyst":true,"not_affected_if":["no-wifi-hardware"],"who_is_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack, such as laptops, desktops and embedded devices that use Wi-Fi through a mac80211 driver. Servers and hosts without a Wi-Fi interface are unlikely to load this code path, and the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":3543,"output_tokens":654,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98707':17A,20A 'ack':8A,41B 'attack':68B 'attempt':196C 'ba':103C,112C 'bar':142C 'becom':197C 'beyond':70B 'block':7A,40B 'block-ack':6A,39B 'callback':133C,186C 'check':218C 'code':86B 'crash':83B 'critic':161C 'ctrl':233C 'cve':15A,18A 'delet':165C,179C 'derefer':145C 'equival':227C 'execut':87B 'fi':5A,35B 'fire':11A 'follow':93C 'free':75B,187C 'freed':53B,122C,138C 'get':69B 'guard':228C 'h':232C 'handler':57B,143C,171C 'ieee80211':230C 'ineffect':198C 'infrastructur':21B 'keep':202C 'kernel':2A,24B,30B,77B,91C 'later':125C 'leav':115C 'linux':1A,23B,29B,90C 'linux-kernel':22B 'lock':213C,239C 'mac80211':25B,32B,99C 'mark':207C 'mean':81B 'memori':51B,78B,139C 'path':217C 'possibl':85B 'process':129C 'queu':46B,119C 'rcu':149C,185C 'read':159C 'read-sid':158C 'rearm':59B,174C,195C,222C,234C 'receiv':38B 'releas':216C 'remov':210C 'reorder':203C,212C,238C 'resolv':97C 'return':181C 'run':136C 'rx':102C,111C,124C,141C,147C,189C,231C 'say':65B 'section':162C 'session':13A,42B,49B,104C,113C,117C,167C,209C,223C 'shut':100C 'shutdown':192C 'side':160C 'sourc':62B 'stack':36B 'stale':56B,170C 'start':201C 'state':220C 'stay':45B,155C 'sync':180C,193C 'take':237C 'tear':108C 'teardown':14A,107C,151C,164C,200C,206C 'tid':123C,146C,188C 'timer':9A,43B,105C,118C,127C,132C,168C,176C,178C,191C,204C,224C 'timer-wheel':126C 'typic':80B 'unchang':205C 'unpublish':152C 'use':73B,190C 'use-after-fre':72B 'vulner':94C 'wheel':128C 'wi':4A,34B 'wi-fi':3A,33B 'wifi':26B,98C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack, such as laptops, desktops and embedded devices that use Wi-Fi through a mac80211 driver. Servers and hosts without a Wi-Fi interface are unlikely to load this code path, and the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98707","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-21T13:21:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}