CVE-2026-98192
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bdUpgrade to: 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bdAffected: ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < 2bddc5d088cf430ecd913020472f1def32a36a3dUpgrade to: 2bddc5d088cf430ecd913020472f1def32a36a3dAffected: ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < c0df0878e9110909cf0bec6080d72d36401a0c89Upgrade to: c0df0878e9110909cf0bec6080d72d36401a0c89Affected: ≥ fdf21cc3714939dd4327f3d664fe5863d15ccb31, < d9be5e75530772fc31637070d51e5717d6aeaa2aUpgrade to: d9be5e75530772fc31637070d51e5717d6aeaa2aStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d
- git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd
- git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89
And 1 more reference. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI