CVE-2026-98192

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98192

EUVD

EUVD-2026-93120

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	fdf21cc3714939dd4327f3d664fe5863d15ccb31
Linux	Linux	fdf21cc3714939dd4327f3d664fe5863d15ccb31
Linux	Linux	fdf21cc3714939dd4327f3d664fe5863d15ccb31
Linux	Linux	fdf21cc3714939dd4327f3d664fe5863d15ccb31
Linux	Linux	5.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the wcn36xx WiFi driver. The TX ack timer is torn down improperly using timer_delete(), which does not wait for an ongoing callback. This allows the callback wcn36xx_dxe_tx_timer() to continue running after the timer is deleted, potentially accessing freed memory and causing system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's wcn36xx WiFi driver and involves a use-after-free condition in the TX ack timer teardown. Detection requires kernel-level inspection rather than network commands. Check kernel logs for crashes or warnings related to wcn36xx or TX ack timer issues. Use dmesg | grep wcn36xx to search for driver-related errors.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. It specifically affects systems using the wcn36xx WiFi driver, potentially disrupting network connectivity and causing kernel-level failures.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue in the Linux wifi driver. It involves a use-after-free in the TX ack timer teardown, which could lead to system instability or crashes but does not inherently impact data privacy or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that replaces timer_delete() with timer_shutdown_sync() in the wcn36xx driver. Update to a kernel version containing this fix. If immediate patching is not possible, disable the wcn36xx driver or avoid using affected WiFi hardware until patched.

Hi! I’m here to help you understand CVE-2026-98192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70