Look up another CVE · open CVE-2026-74489 in the interactive tracker

CVE-2026-74489

wifi: mac80211: fix tid_tx use-after-free on BA session stop

8.8 EPSS 0.3% AV:A

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-74489 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.8-1	Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.8-1	Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping sta->lock: ieee80211_remove_tid_tx(sta, tid); /* kfree_rcu(tid_tx, rcu_head) */ ... spin_unlock_bh(&sta->lock); if (start_txq) ieee80211_agg_start_txq(sta, tid, false); if (send_delba) ieee80211_send_delba(..., tid_tx->ndp); That read is not covered by an RCU read-side critical section, and it runs in preemptible process context: both callers hold the wiphy mutex, reaching it either from the ieee80211_ba_session_work() wiphy work or from ieee80211_sta_tear_down_BA_sessions() during station teardown. Softirqs can run in that window too, both from the local_bh_enable() that ends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU callback can free tid_tx before the read. Driving the function from a test module with the grace period forced into that window, KASAN reports the read, and the free arrives on the ordinary RCU softirq path: BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd/0x400 Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10 [...] Freed by task 57: __kasan_slab_free+0x47/0x70 __rcu_free_sheaf_prepare+0x70/0x250 rcu_free_sheaf_nobarn+0x18/0x40 rcu_core+0x426/0x1310 handle_softirqs+0x144/0x590 __irq_exit_rcu+0xea/0x150 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x6b/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 send_delba is only set when tx_stop is set, which happens for AGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown - session idle timeout, PTK rekey, suspend, HW reconfig - and not from a peer's DELBA. Read ndp into a local before the session is freed, while sta->lock is still held. tid_tx->ndp has a single writer, in ieee80211_tx_ba_session_handle_start(), which cannot run concurrently here: both paths are serialised by the wiphy mutex, and the session is already marked HT_AGG_STATE_STOPPING at this point. tid_tx->ndp is also the only tid_tx dereference left after ieee80211_remove_tid_tx() in this function. [move/change the comment a bit to be more general not just on ndp, initialize ndp directly]

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/mac80211/agg-tx.c

What this is: MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
Kernel module: mac80211

Check it on the machine

grep -w CONFIG_MAC80211 /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w mac80211

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_MAC80211

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: adjacent network (AV:A)source
EPSS: 0.34%, higher than 26.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: net/mac80211

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
7.1	7.1.8	09fc36eec784
7.1	7.2	2f067f5a450e

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network: The bug is in mac80211 WiFi block-ack teardown; an adjacent 802.11 peer with an active TX BA session can drive AGG_STOP_LOCAL_REQUEST via negotiated session-idle timeouts, PTK rekey, or link conditions that cause local session stop.
AC:LAttack complexity, low: This is a slab use-after-free where RCU can free tid_tx between ieee80211_remove_tid_tx() and the post-unlock tid_tx->ndp read; the commit reproduced it reliably, and an attacker can repeatedly trigger local BA teardown to hit the race window.
PR:NPrivileges required, none: Exploitation requires no Linux user or administrator privileges on the victim, only normal 802.11 association as a WiFi peer to maintain a block-ack session that later undergoes local teardown.
UI:NUser interaction, none: No victim interaction beyond routine WiFi connectivity is needed; session-idle timers, rekey, and driver-initiated local BA stop can fire from background wireless activity without the user performing a specific action.
S:UScope, unchanged: Impact is confined to kernel memory corruption and privilege escalation within the host kernel; it does not cross a VM, IOMMU, or sandbox security boundary.
C:HConfidentiality impact, high: Reading tid_tx->ndp after kfree_rcu() is a slab use-after-free of a kernel heap object, which can disclose or infer kernel memory contents and support further exploitation primitives.
I:HIntegrity impact, high: Use-after-free of tid_ampdu_tx enables heap corruption and control of freed object contents, which can be leveraged for arbitrary kernel writes or code execution beyond the single-byte ndp read.
A:HAvailability impact, high: The freed-object dereference can cause kernel oops/panic; KASAN reported slab-use-after-free in ieee80211_stop_tx_ba_cb during BA session stop, and UAFs in mac80211 commonly crash the system.