# CVE-2026-74489: linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: fix tid_tx use-after-free on BA...

CVE-2026-74489 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74489 (version 7.1.8-1), released August 16, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-74489
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0034
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 15, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: fix tid_tx use-after-free on BA session stop  ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping sta->lock:  	ieee80211_remove_tid_tx(sta, tid);	/* kfree_rcu(tid_tx, rcu_head) */ 	... 	spin_unlock_bh(&sta->lock);  	if (start_txq) 		ieee80211_agg_start_txq(sta, tid, false);  	if (send_delba) 		ieee80211_send_delba(..., tid_tx->ndp);  That read is not covered by an RCU read-side critical section, and it runs in preemptible process context: both callers hold the wiphy mutex, reaching it either from the ieee80211_ba_session_work() wiphy work or from ieee80211_sta_tear_down_BA_sessions() during station teardown. Softirqs can run in that window too, both from the local_bh_enable() that ends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU callback can free tid_tx before the read.  Driving the function from a test module with the grace period forced into that window, KASAN reports the read, and the free arrives on the ordinary RCU softirq path:    BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd/0x400   Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10   [...]   Freed by task 57:    __kasan_slab_free+0x47/0x70    __rcu_free_sheaf_prepare+0x70/0x250    rcu_free_sheaf_nobarn+0x18/0x40    rcu_core+0x426/0x1310    handle_softirqs+0x144/0x590    __irq_exit_rcu+0xea/0x150    irq_exit_rcu+0x9/0x20    sysvec_apic_timer_interrupt+0x6b/0x80    asm_sysvec_apic_timer_interrupt+0x1a/0x20  send_delba is only set when tx_stop is set, which happens for AGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown - session idle timeout, PTK rekey, suspend, HW reconfig - and not from a peer's DELBA.  Read ndp into a local before the session is freed, while sta->lock is still held. tid_tx->ndp has a single writer, in ieee80211_tx_ba_session_handle_start(), which cannot run concurrently here: both paths are serialised by the wiphy mutex, and the session is already marked HT_AGG_STATE_STOPPING at this point. tid_tx->ndp is also the only tid_tx dereference left after ieee80211_remove_tid_tx() in this function.  [move/change the comment a bit to be more general not just on ndp,  initialize ndp directly]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.8-1 | [DEBIAN-CVE-2026-74489](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74489.md) | Aug 16, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.