CVE-2026-98194

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98194

EUVD

EUVD-2026-93122

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	06b16ae5319251c26377afcb401e46056d5673f4
Linux	Linux	2.6.28

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's libertas_tf Wi-Fi driver. The issue occurs in the lbtf_free_adapter() function where command buffers are freed before a timer callback completes. If the timer callback runs during or after freeing, it may access already freed memory, leading to crashes or potential code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's libertas_tf WiFi driver and involves a use-after-free (UAF) condition in lbtf_free_adapter(). Detection requires checking the kernel version and driver status. Use commands like 'uname -a' to verify kernel version and 'lsmod | grep libertas_tf' to check if the vulnerable driver is loaded.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or arbitrary code execution on affected Linux systems using the libertas_tf Wi-Fi driver. Users may experience Wi-Fi disconnections or kernel panics.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel memory management issue in the wifi subsystem. Compliance impacts would depend on system-specific implementations and data handling practices rather than this technical flaw.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Check your distribution's security updates and apply them. If updating is not immediately possible, consider disabling the libertas_tf driver if not in use with 'modprobe -r libertas_tf'.

Hi! I’m here to help you understand CVE-2026-98194. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70