CVE-2026-98706
Received Received - Intake

WiFi PS Frame Delivery Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update num_sta_ps and the power-save queues after station cleanup has purged them. sta_deliver_ps_frames() tests sta->dead only before it starts delivery. A worker that passes that test can be delayed while teardown sets sta->dead and removes the station from the driver; when it resumes it still runs the full delivery. The existing cancel_work_sync() sits near the end of __cleanup_single_sta(), after the final driver state transition and after PS accounting and queue purging, so it drains the worker only once the state it has to protect has already changed. Before commit d34ba2168a3c ("mac80211: don't delay station destruction") cleanup was deferred through the same ordered workqueue as the delivery work, which kept the two ordered. Cancel the work after setting sta->dead and before moving the driver state, and move the existing cancellation to the start of __cleanup_single_sta(). The first drain closes the driver-lifetime window; driver callbacks during the remaining state transitions can still queue drv_deliver_wk through ieee80211_sta_block_awake(), so retain the second drain at the start of __cleanup_single_sta(). That drain also covers insertion failures, which reach cleanup without setting sta->dead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98706
EUVD
EUVD-2026-103960

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux d34ba2168a3c10e7301cca06069c39865b4c3ec6
Linux Linux d34ba2168a3c10e7301cca06069c39865b4c3ec6
Linux Linux d34ba2168a3c10e7301cca06069c39865b4c3ec6
Linux Linux d34ba2168a3c10e7301cca06069c39865b4c3ec6
Linux Linux 3.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition during the removal of a Wi-Fi access point or mesh station. When a station is removed, the system may attempt to deliver power-saving frames after the station has already been cleaned up, leading to potential driver state inconsistencies. The issue arises because the power-save frame delivery worker may run after the station is marked as dead but before the driver state is fully updated.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and relates to station teardown processes. Detection requires checking kernel logs for related errors or monitoring for abnormal AP/mesh station removal behavior. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to system instability or crashes when removing Wi-Fi stations, potentially causing denial-of-service conditions. Attackers on the same network might exploit this to trigger kernel issues, leading to unexpected reboots or degraded performance.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. The vulnerability is resolved in newer kernels, so applying the latest stable updates is recommended. Monitor kernel changelogs for the specific patch (commit d34ba2168a3c).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart