CVE-2026-98192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98192", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.323Z", "datePublished": "2026-10-06T08:44:32.912Z", "dateUpdated": "2026-10-30T12:37:53.227Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:53.227Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,\nreads wcn->tx_ack_skb and passes wcn->hw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/wcn36xx/dxe.c"], "versions": [{"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "915298dbb766d2311b0822ab6ef24780def0bd53", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "e7f265d507ee55017b67ef4722df884468be1113", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "7ce1e55a439968a298a63d3199cb1c2636429746", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "15e59e377facc87ce82228279d88efaa89fdbca5", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "2bddc5d088cf430ecd913020472f1def32a36a3d", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "c0df0878e9110909cf0bec6080d72d36401a0c89", "status": "affected", "versionType": "git"}, {"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "lessThan": "d9be5e75530772fc31637070d51e5717d6aeaa2a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/wcn36xx/dxe.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/915298dbb766d2311b0822ab6ef24780def0bd53"}, {"url": "https://git.kernel.org/stable/c/e7f265d507ee55017b67ef4722df884468be1113"}, {"url": "https://git.kernel.org/stable/c/7ce1e55a439968a298a63d3199cb1c2636429746"}, {"url": "https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5"}, {"url": "https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd"}, {"url": "https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d"}, {"url": "https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89"}, {"url": "https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a"}], "title": "wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/wcn36xx/dxe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "915298dbb766d2311b0822ab6ef24780def0bd53", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "e7f265d507ee55017b67ef4722df884468be1113", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "7ce1e55a439968a298a63d3199cb1c2636429746", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "15e59e377facc87ce82228279d88efaa89fdbca5", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "2bddc5d088cf430ecd913020472f1def32a36a3d", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "c0df0878e9110909cf0bec6080d72d36401a0c89", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}, {"lessThan": "d9be5e75530772fc31637070d51e5717d6aeaa2a", "status": "affected", "version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/wcn36xx/dxe.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,\nreads wcn->tx_ack_skb and passes wcn->hw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-98192", "lastModified": "2026-10-30T13:21:11.800", "metrics": {}, "published": "2026-10-06T09:18:04.537", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ce1e55a439968a298a63d3199cb1c2636429746"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/915298dbb766d2311b0822ab6ef24780def0bd53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7f265d507ee55017b67ef4722df884468be1113"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown", "id": "2546510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546510"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability can lead to a Denial of Service (DoS) or system instability due to a use-after-free condition. When deinitializing the transmission acknowledgement timer during device removal, the driver stops the timer without waiting for active callbacks to finish, allowing callback routines to access memory that has already been deallocated. A local user could exploit this race condition during driver teardown to crash the system."], "name": "CVE-2026-98192", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98192\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98192\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98192.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fdf21cc3714939dd4327f3d664fe5863d15ccb31,3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fdf21cc3714939dd4327f3d664fe5863d15ccb31,2bddc5d088cf430ecd913020472f1def32a36a3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fdf21cc3714939dd4327f3d664fe5863d15ccb31,c0df0878e9110909cf0bec6080d72d36401a0c89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fdf21cc3714939dd4327f3d664fe5863d15ccb31,d9be5e75530772fc31637070d51e5717d6aeaa2a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T12:30:10.406987+00:00", "updated": "2026-10-09T05:30:08.769986+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}