UBUNTU-CVE-2026-98707: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory. An RX BAR handler can dereference tidrx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timerdeletesync() returns and before the RCU callback frees tidrx. Use timershutdownsync() so rearm attempts become ineffective once teardown starts. Keep reordertimer unchanged: teardown marks the session removed under reorderlock and its release path checks that state before rearming. sessiontimer has no equivalent guard because ieee80211rxhctrl() rearms it before taking reorderlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the mac80211 RX BA session teardown path, replace timer_delete_sync() with timer_shutdown_sync() for session_timer so timer rearm attempts become ineffective once teardown starts; leave reorder_timer unchanged.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to interact with the affected system over an adjacent network and trigger a timing-sensitive race involving teardown of an 802.11 RX block-acknowledgment session and handling of an RX BAR frame. No privileges or user interaction are required.
Which Ubuntu kernel packages are identified as affected?
The listed affected packages are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.
What is the consequence if the race succeeds?
A queued or rearmed session timer can run after its tid_rx structure has been freed, causing timer processing or its callback to access freed memory. The vulnerability is rated high and affects confidentiality, integrity, and availability.
What change addresses the race?
The fix uses timer_shutdown_sync() during RX BA session teardown so that attempts to rearm the session timer are ineffective after teardown begins. The reorder timer is not changed because its existing teardown and rearm logic includes a removed-state check under reorder_lock.