SB20261022312 - Use-after-free in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98707)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to use-after-free in mac80211 RX BA session timer handling when an RX BAR handler races with session teardown. A remote attacker on the local network can send RX BAR frames during teardown to cause a stale handler to rearm the session timer, potentially causing subsequent timer processing to access freed memory and crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba
• https://git.kernel.org/stable/c/481f9230284c27052b59c587069f232c5d84779e
• https://git.kernel.org/stable/c/7bb2a5bd4f07192fca35644fab7d49a17bfbc861
• https://git.kernel.org/stable/c/d0da6ab1fc53a68025929baf0947519c6c1684dc
• https://git.kernel.org/stable/c/e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e