CVE-2026-98192 - Vulnerability Details

- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),
which only dequeues the timer and does not wait for a callback that is
already executing; the preceding free_irq() calls synchronize the
interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can
therefore be running past the teardown and use the wcn freed along
with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,
reads wcn->tx_ack_skb and passes wcn->hw to
ieee80211_tx_status_irqsafe().

Fix this by using timer_shutdown_sync(), which waits for a running
callback and also prevents the timer from being rearmed again. The
timer is set up again by wcn36xx_dxe_init() on the next start, so the
start/stop cycle is unaffected.

This issue was found by an in-house static analysis tool.

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free bug exists in the Linux kernel’s wcn36xx Wi‑Fi driver. During TX acknowledge timer teardown, a timer deletion with timer_delete() does not wait for a callback that may still be running. The callback wcn36xx_dxe_tx_timer() can therefore access a freed wcn structure, which leads to kernel memory corruption. This flaw can impact system stability and integrity.

Affected Systems

All Linux kernel installations that contain the wcn36xx Wi‑Fi driver are affected. The vulnerability is present in every kernel build up to the patch that replaces timer_delete() with timer_shutdown_sync(). No specific kernel version list is provided, so any kernel compiled with the wcn36xx driver before the commit is vulnerable.

Risk and Exploitability

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to trigger the timer teardown. Remote exploitation would require the driver to be exposed through a network service or for the attacker to cause a transmit event that reaches the kernel. The CVSS score of 5.5 reflects a moderate severity for kernel memory corruption, which still warrants attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fdf21cc3714939dd4327f3d664fe5863d15ccb31`	affected	< 15e59e377facc87ce82228279d88efaa89fdbca5
`fdf21cc3714939dd4327f3d664fe5863d15ccb31`	affected	< 3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd
`fdf21cc3714939dd4327f3d664fe5863d15ccb31`	affected	< 2bddc5d088cf430ecd913020472f1def32a36a3d
`fdf21cc3714939dd4327f3d664fe5863d15ccb31`	affected	< c0df0878e9110909cf0bec6080d72d36401a0c89
`fdf21cc3714939dd4327f3d664fe5863d15ccb31`	affected	< d9be5e75530772fc31637070d51e5717d6aeaa2a

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`6.6.160`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fdf21cc3714939dd4327f3d664fe5863d15ccb31,3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd)`	affected	code_commit	—
`[fdf21cc3714939dd4327f3d664fe5863d15ccb31,2bddc5d088cf430ecd913020472f1def32a36a3d)`	affected	code_commit	—
`[fdf21cc3714939dd4327f3d664fe5863d15ccb31,c0df0878e9110909cf0bec6080d72d36401a0c89)`	affected	code_commit	—
`[fdf21cc3714939dd4327f3d664fe5863d15ccb31,d9be5e75530772fc31637070d51e5717d6aeaa2a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates the timer_shutdown_sync() patch for the wcn36xx driver.
Disable the wcn36xx Wi‑Fi module (e.g., unload the driver or block the wireless device) until a patched kernel is available.
Keep monitoring the Linux kernel release notes or vendor advisories for the wcn36xx fix and apply the update as soon as it is released.

Generated by OpenCVE AI on October 9, 2026 at 05:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98192.mbox
https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5
https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d
https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd
https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89
https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a
https://nvd.nist.gov/vuln/detail/CVE-2026-98192
https://www.cve.org/CVERecord?id=CVE-2026-98192

History

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5

Fri, 09 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98192.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98192 https://www.cve.org/CVERecord?id=CVE-2026-98192
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 07 Oct 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 07 Oct 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 06 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool.
Title		wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89 https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:32.912Z

Updated: 2026-10-21T12:54:50.525Z

Reserved: 2026-09-25T10:25:14.323Z

Link: CVE-2026-98192

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:04.537

Modified: 2026-10-21T13:21:25.300

Link: CVE-2026-98192

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98192 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T05:30:08Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object