CVE-2026-74489

A flaw was found in the Linux kernel's mac80211 component, which manages Wi-Fi (Wireless Fidelity) networking. This use-after-free vulnerability occurs during the stopping of a Block Acknowledgement (BA) session. An attacker within the same network segment could exploit this by triggering the BA session teardown, leading to memory corruption. This could result in a denial of service, information disclosure, or potentially arbitrary code execution, severely impacting the system's confidentiality, integrity, and availability.

A use after free in mac80211 BA session teardown can occur because ieee80211_stop_tx_ba_cb frees tid_tx through ieee80211_remove_tid_tx and later reads tid_tx ndp after dropping sta lock. The read is outside an RCU read side critical section and can race with the normal RCU softirq free path in preemptible process context. The base impact is a local denial of service through a kernel crash, with high attack complexity because a narrow timing window must be hit. For the CVSS the PR:N is used in the paranoid score because an adjacent WiFi peer or AP may be able to influence BA session lifetime without local code execution on the victim. The issue is not a generic Internet reachable bug, but practical exposure may exist on systems using WiFi aggregation where an attacker is in radio range or controls the connected AP. Impact is at least denial of service. In worst case it may allow limited confidentiality or integrity impact due to the UAF class and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.