Answer in brief
CVE-2026-98707 records a Unknown severity vulnerability in wifi: mac80211: shut down RX BA session timer on teardown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a87f736d942c86255e3088c606f0e3eab6bbf784 <7bb2a5bd4f07192fca35644fab7d49a17bfbc861 || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <481f9230284c27052b59c587069f232c5d84779e || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e | 7bb2a5bd4f07192fca35644fab7d49a17bfbc861, 481f9230284c27052b59c587069f232c5d84779e, 09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba, e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e |
| Linux/Linuxgeneric | 2.6.36 | Not reported |
| Linux/Linuxgeneric | >=a87f736d942c86255e3088c606f0e3eab6bbf784 <d0da6ab1fc53a68025929baf0947519c6c1684dc || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <7bb2a5bd4f07192fca35644fab7d49a17bfbc861 || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <481f9230284c27052b59c587069f232c5d84779e || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba || >=a87f736d942c86255e3088c606f0e3eab6bbf784 <e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e | d0da6ab1fc53a68025929baf0947519c6c1684dc, 7bb2a5bd4f07192fca35644fab7d49a17bfbc861, 481f9230284c27052b59c587069f232c5d84779e, 09b7d5e4f88504e62ddf4ff31ebeebb3b87578ba, e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callback itself then run against freed memory. An RX BAR handler can dereference tid_rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer_delete_sync() returns and before the RCU callback frees tid_rx. Use timer_shutdown_sync() so rearm attempts become ineffective once teardown starts. Keep reorder_timer unchanged: teardown marks the session removed under reorder_lock and its release path checks that state before rearming. session_timer has no equivalent guard because ieee80211_rx_h_ctrl() rearms it before taking reorder_lock.
Quoted source text, attributed separately from HOL analysis.