CVE-2026-98707: wifi: mac80211: shut down RX BA session timer on teardown
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: shut down RX BA session timer on teardown
Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory.
An RX BAR handler can dereference tidrx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timerdeletesync() returns and before the RCU callback frees tidrx.
Use timershutdownsync() so rearm attempts become ineffective once teardown starts. Keep reordertimer unchanged: teardown marks the session removed under reorderlock and its release path checks that state before rearming. sessiontimer has no equivalent guard because ieee80211rxhctrl() rearms it before taking reorderlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Use timer_shutdown_sync() when tearing down the RX BA session timer so timer rearm attempts become ineffective before the RCU callback frees tid_rx.
Event History
Frequently Asked Questions
What conditions are required for the use-after-free to occur?
An RX BA session must be torn down while an RX BAR handler has already obtained tid_rx under RCU and remains in its read-side critical section. The handler can then rearm the session timer after teardown deletes it but before the RCU callback frees tid_rx.
Why is synchronously deleting the timer not sufficient in this case?
timer_delete_sync() waits for an active timer callback, but it does not prevent the stale RX BAR handler from rearming the timer after deletion completes. timer_shutdown_sync() makes rearm attempts ineffective once teardown begins.
Does the same issue apply to the reorder timer?
No. The reorder timer is left unchanged because teardown marks the session removed under reorder_lock, and the reorder timer release path checks that state before attempting to rearm it.