CVE-2026-72070

Received Received - Intake

Use-After-Free in Linux Kernel Libertas TF WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() lbtf_free_adapter() calls timer_delete(&priv->command_timer), which does not wait for a running command_timer_fn() callback. lbtf_free_adapter() runs on the teardown path right before ieee80211_free_hw() frees priv, both in lbtf_remove_card() and in the probe error path. command_timer is armed by mod_timer() in lbtf_cmd() whenever a firmware command is sent. command_timer_fn() dereferences priv. If a command times out as the device is removed, command_timer_fn() runs concurrently with teardown and dereferences priv after it has been freed. This is the same use-after-free that commit 03cc8f90d053 ("wifi: libertas: fix use-after-free in lbs_free_adapter()") fixed in the sibling libertas driver. The libertas_tf variant has the identical pattern and was left unchanged. Use timer_delete_sync() so any in-flight callback completes before priv is freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72070

EUVD

EUVD-2026-59028

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's libertas_tf Wi-Fi driver. It occurs when lbtf_free_adapter() deletes a timer without waiting for a potentially running timer callback. If a firmware command times out during device removal, the callback may try to access freed memory, causing a crash or security issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's libertas_tf WiFi driver and involves a use-after-free condition in lbtf_free_adapter(). Detection requires checking for kernel logs or crashes related to the libertas_tf module or WiFi subsystem. Monitor for kernel oops messages or system crashes during WiFi operations.

Impact Analysis

This could cause system crashes, kernel panics, or potential privilege escalation if exploited. Users may experience sudden system failures when removing Wi-Fi devices or during network operations.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's wifi driver (libertas_tf) that could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, disable the libertas_tf module by blacklisting it in your system's module configuration to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-72070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70