CVE-2026-23281
Use-After-Free in Linux Kernel Libertass WiFi Driver Timers
Publication date: 2026-03-25
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libertas | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's libertas wifi driver, specifically in the function lbs_free_adapter().
The problem arises because lbs_free_adapter() uses timer_delete() to delete timers (command_timer and tx_lockup_timer) before freeing the structure. However, timer_delete() does not wait for any running timer callback to finish.
If a timer callback is running when lbs_free_adapter() is called, it may access memory that has already been freed, leading to use-after-free violations. The callbacks access various fields in the freed structure, which can cause undefined behavior or crashes.
The fix is to use timer_delete_sync() instead, which waits for any running timer callback to complete before returning, preventing access to freed memory.
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to instability or crashes in the Linux kernel's wifi driver, potentially causing system crashes or denial of service.
Because the timer callbacks access freed memory, it could also lead to unpredictable behavior or security risks such as memory corruption.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the use of timer_delete() instead of timer_delete_sync() in the lbs_free_adapter() function, leading to use-after-free issues.
To mitigate this vulnerability, update the Linux kernel to a version where this issue is fixed by replacing timer_delete() calls with timer_delete_sync() in the libertas driver cleanup path.