{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74489 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74489 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74489 and fix it if it is affected.\n\nWhat it is: CVE-2026-74489 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74489 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74489/ (Markdown: https://insights.sbomify.com/CVE-2026-74489/index.md)","id":"CVE-2026-74489","markdown":"https://insights.sbomify.com/CVE-2026-74489/index.md","name":"CVE-2026-74489","record":{"aliases":["DEBIAN-CVE-2026-74489","GHSA-qpmf-fc23-r543","UBUNTU-CVE-2026-74489"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Wi-Fi","requires_auth":"none","summary":"A use-after-free in the Linux kernel Wi-Fi subsystem allows attackers to cause denial of service or potentially execute code during Block Ack session teardown.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix tid_tx use-after-free on BA session stop\n\nieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through\nieee80211_remove_tid_tx(), and then reads tid_tx-\u003endp after dropping\nsta-\u003elock:\n\n\tieee80211_remove_tid_tx(sta, tid);\t/* kfree_rcu(tid_tx, rcu_head) */\n\t...\n\tspin_unlock_bh(\u0026sta-\u003elock);\n\n\tif (start_txq)\n\t\tieee80211_agg_start_txq(sta, tid, false);\n\n\tif (send_delba)\n\t\tieee80211_send_delba(..., tid_tx-\u003endp);\n\nThat read is not covered by an RCU read-side critical section, and it runs\nin preemptible process context: both callers hold the wiphy mutex, reaching\nit either from the ieee80211_ba_session_work() wiphy work or from\nieee80211_sta_tear_down_BA_sessions() during station teardown.\nSoftirqs can run in that window too, both from the local_bh_enable() that\nends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU\ncallback can free tid_tx before the read.\n\nDriving the function from a test module with the grace period forced into\nthat window, KASAN reports the read, and the free arrives on the ordinary\nRCU softirq path:\n\n  BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd/0x400\n  Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10\n  [...]\n  Freed by task 57:\n   __kasan_slab_free+0x47/0x70\n   __rcu_free_sheaf_prepare+0x70/0x250\n   rcu_free_sheaf_nobarn+0x18/0x40\n   rcu_core+0x426/0x1310\n   handle_softirqs+0x144/0x590\n   __irq_exit_rcu+0xea/0x150\n   irq_exit_rcu+0x9/0x20\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nsend_delba is only set when tx_stop is set, which happens for\nAGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown -\nsession idle timeout, PTK rekey, suspend, HW reconfig - and not from a\npeer's DELBA.\n\nRead ndp into a local before the session is freed, while sta-\u003elock is still\nheld. tid_tx-\u003endp has a single writer, in\nieee80211_tx_ba_session_handle_start(), which cannot run concurrently here:\nboth paths are serialised by the wiphy mutex, and the session is already\nmarked HT_AGG_STATE_STOPPING at this point. tid_tx-\u003endp is also the only\ntid_tx dereference left after ieee80211_remove_tid_tx() in this function.\n\n[move/change the comment a bit to be more general not just on ndp,\n initialize ndp directly]","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: mac80211: fix tid_tx use-after-free on BA session stop","id":"CVE-2026-74489","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"tipc: avoid use-after-free in poll trace queue dumps","id":"CVE-2026-74490"},"packages":[],"prev":{"headline":"wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames","id":"CVE-2026-74488"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel Wi-Fi subsystem allows attackers to cause denial of service or potentially execute code during Block Ack session teardown.","url":"https://insights.sbomify.com/CVE-2026-74489/"}