---
id: CVE-2026-98707
title: 'wifi: mac80211: shut down RX BA session timer on teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: shut down RX BA session timer on teardown

  Tearing down an RX BA session can leave the session timer queued on a
  freed tid_rx. Later timer-wheel process…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 <
    7bb2a5bd4f07192fca35644fab7d49a17bfbc861
  - >-
    Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 <
    481f9230284c27052b59c587069f232c5d84779e
  - >-
    Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 <
    09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba
  - >-
    Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 <
    e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e
  - Linux 2.6.36
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:37.587Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98707'
references:
  - url: 'https://git.kernel.org/stable/c/7bb2a5bd4f07192fca35644fab7d49a17bfbc861'
  - url: 'https://git.kernel.org/stable/c/481f9230284c27052b59c587069f232c5d84779e'
  - url: 'https://git.kernel.org/stable/c/09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba'
  - url: 'https://git.kernel.org/stable/c/e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.513Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: shut down RX BA session timer on teardown

Tearing down an RX BA session can leave the session timer queued on a
freed tid_rx. Later timer-wheel processing and the timer callback itself
then run against freed memory.

An RX BAR handler can dereference tid_rx under RCU before teardown
unpublishes it and stay in its read-side critical section while teardown
deletes the session timer. The stale handler can then rearm the timer
after timer_delete_sync() returns and before the RCU callback frees
tid_rx.

Use timer_shutdown_sync() so rearm attempts become ineffective once
teardown starts. Keep reorder_timer unchanged: teardown marks the session
removed under reorder_lock and its release path checks that state before
rearming. session_timer has no equivalent guard because
ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.

## Affected

- `Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 < 7bb2a5bd4f07192fca35644fab7d49a17bfbc861`
- `Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 < 481f9230284c27052b59c587069f232c5d84779e`
- `Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 < 09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba`
- `Linux >= a87f736d942c86255e3088c606f0e3eab6bbf784 < e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e`
- `Linux 2.6.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.