Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid_tx use-after-free on BA session stop ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping sta->lock: ieee80211_remove_tid_tx(sta, tid); /* kfree_rcu(tid_tx, rcu_head) */ ... spin_unlock_bh(&sta->lock); if (start_txq) ieee80211_agg_start_txq(sta, tid, false); if (send_delba) ieee80211_send_delba(..., tid_tx->ndp); That read is not covered by an RCU read-side critical section, and it runs in preemptible process context: both callers hold the wiphy mutex, reaching it either from the ieee80211_ba_session_work() wiphy work or from ieee80211_sta_tear_down_BA_sessions() during station teardown. Softirqs can run in that window too, both from the local_bh_enable() that ends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU callback can free tid_tx before the read. Driving the function from a test module with the grace period forced into that window, KASAN reports the read, and the free arrives on the ordinary RCU softirq path: BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd/0x400 Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10 [...] Freed by task 57: __kasan_slab_free+0x47/0x70 __rcu_free_sheaf_prepare+0x70/0x250 rcu_free_sheaf_nobarn+0x18/0x40 rcu_core+0x426/0x1310 handle_softirqs+0x144/0x590 __irq_exit_rcu+0xea/0x150 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x6b/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 send_delba is only set when tx_stop is set, which happens for AGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown - session idle timeout, PTK rekey, suspend, HW reconfig - and not from a peer's DELBA. Read ndp into a local before the session is freed, while sta->lock is still held. tid_tx->ndp has a single writer, in ieee80211_tx_ba_session_handle_start(), which cannot run concurrently here: both paths are serialised by the wiphy mutex, and the session is already marked HT_AGG_STATE_STOPPING at this point. tid_tx->ndp is also the only tid_tx dereference left after ieee80211_remove_tid_tx() in this function. [move/change the comment a bit to be more general not just on ndp, initialize ndp directly]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:53.813Z",
  "pubdate": "2026-08-15T13:17:53.813Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel mac80211 subsystem, specifically within the Block Agreement (BA) session teardown handling in `ieee80211_stop_tx_ba_cb()`. The vulnerability arises due to an insecure object dereferencing sequence where `tid_tx` is passed to `kfree_rcu()` via `ieee80211_remove_tid_tx()` while holding `sta->lock`, but a subsequent read operation (`tid_tx->ndp`) occurs after the lock is dropped without an active RCU read-side critical section.\nThe impact of this vulnerability includes potential kernel memory corruption, system instability, and kernel panics resulting from reading freed memory structures. This flaw affects systems utilizing the Linux kernel mac80211 wireless stack.\nExploitation of this vulnerability requires local execution context or trigger conditions associated with local Block Agreement session teardowns, such as session idle timeouts, PTK rekeying, system suspension, or hardware reconfiguration. Attackers or local triggers can induce race conditions where the RCU callback frees the `tid_tx` structure before the final dereference completes, leading to kernel crashes as documented by KASAN reports.",
  "technicalDetails": "The root cause of the vulnerability resides in improper memory management and synchronization during the cessation of wireless transmitter Block Agreement sessions in the Linux kernel mac80211 subsystem. Specifically, the function `ieee80211_stop_tx_ba_cb()` invokes `ieee80211_remove_tid_tx()`, which immediately queues the transmission identifier structure `tid_tx` for asynchronous reclamation via `kfree_rcu(tid_tx, rcu_head)`. Following this invocation, the function releases `sta->lock` and subsequently attempts to read `tid_tx->ndp` during the execution of `ieee80211_send_delba()`.\nBecause the read operation of `tid_tx->ndp` occurs outside of any RCU read-side critical section and runs within a preemptible process context holding the wiphy mutex, softirqs are permitted to execute. Softirq processing—triggered either from local Bottom Half enabling or interrupt exits—can safely process pending RCU callbacks and immediately free the slab memory associated with `tid_tx`. Consequently, when the execution flow reaches the `tid_tx->ndp` dereference, the memory has already been deallocated, resulting in a slab use-after-free condition detected by KernelAddressSanitizer (KASAN).\nThe attack flow requires the target system to initiate a local teardown sequence of a TX BA session (such as `AGG_STOP_LOCAL_REQUEST`). When `ieee80211_ba_session_work()` or `ieee80211_sta_tear_down_BA_sessions()` executes, the race window opens between the completion of `ieee80211_remove_tid_tx()` and the final read of `tid_tx->ndp`. If the RCU grace period expires or is forced to elapse within this window (e.g., via specialized test modules or standard timer/softirq scheduling), the kernel accesses stale pointers. While `tid_tx->ndp` possesses a single writer synchronized by the wiphy mutex and marked with `HT_AGG_STATE_STOPPING`, the lack of temporal memory safety guarantees for the reader yields fatal memory corruption or denial of service."
}