CVE-2026-74489

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the mac80211 wifi component. The function ieee80211 stop tx ba cb() passes tid tx to kfree rcu() via ieee80211 remove tid tx() and subsequently reads the ndp variable from tid tx after releasing the sta->lock. Because this read occurs in a preemptible process context without an RCU read-side critical section, a softirq can trigger the RCU callback to free tid tx before the read is completed. This scenario occurs during local teardown events such as session idle timeouts, PTK rekeying, suspension, or hardware reconfiguration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.