CVE-2026-98707

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: shut down RX BA session timer on teardown

Tearing down an RX BA session can leave the session timer queued on a freed tid rx. Later timer-wheel processing and the timer callback itself then run against freed memory.

An RX BAR handler can dereference tid rx under RCU before teardown unpublishes it and stay in its read-side critical section while teardown deletes the session timer. The stale handler can then rearm the timer after timer delete sync() returns and before the RCU callback frees tid rx.

Use timer shutdown sync() so rearm attempts become ineffective once teardown starts. Keep reorder timer unchanged: teardown marks the session removed under reorder lock and its release path checks that state before rearming. session timer has no equivalent guard because ieee80211 rx h ctrl() rearms it before taking reorder lock.