CVE-2026-23281
Received Received - Intake
Use-After-Free in Linux Kernel Libertass WiFi Driver Timers

Publication date: 2026-03-25

Last updated on: 2026-04-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-18
Generated
2026-05-07
AI Q&A
2026-03-25
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
libertas linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a use-after-free issue in the Linux kernel's libertas wifi driver, specifically in the function lbs_free_adapter().

The problem arises because lbs_free_adapter() uses timer_delete() to delete timers (command_timer and tx_lockup_timer) before freeing the structure. However, timer_delete() does not wait for any running timer callback to finish.

If a timer callback is running when lbs_free_adapter() is called, it may access memory that has already been freed, leading to use-after-free violations. The callbacks access various fields in the freed structure, which can cause undefined behavior or crashes.

The fix is to use timer_delete_sync() instead, which waits for any running timer callback to complete before returning, preventing access to freed memory.


How can this vulnerability impact me? :

This use-after-free vulnerability can lead to instability or crashes in the Linux kernel's wifi driver, potentially causing system crashes or denial of service.

Because the timer callbacks access freed memory, it could also lead to unpredictable behavior or security risks such as memory corruption.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is caused by the use of timer_delete() instead of timer_delete_sync() in the lbs_free_adapter() function, leading to use-after-free issues.

To mitigate this vulnerability, update the Linux kernel to a version where this issue is fixed by replacing timer_delete() calls with timer_delete_sync() in the libertas driver cleanup path.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart