CVE-2026-98707

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A race condition during the teardown of a Receive Block Acknowledgement (RX BA) session can allow an internal timer to be rearmed after it has been deleted, leaving it queued on freed memory. An attacker within Wi-Fi range could exploit this issue by sending specially crafted wireless frames, triggering a use-after-free condition that results in a kernel crash and Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires an adjacent attacker within Wi-Fi proximity targeting a system actively using wireless hardware with the mac80211 driver stack. Standard Red Hat server, cloud, and container host environments typically lack physical wireless interfaces, which greatly minimizes overall exposure. While successful exploitation of this race condition can crash the kernel and cause a denial of service, confidentiality and system integrity are not directly compromised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.