CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter()
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix use-after-free in lbsfreeadapter()
The lbsfreeadapter() function uses timerdelete() (non-synchronous) for both commandtimer and txlockuptimer before the structure is freed. This is incorrect because timerdelete() does not wait for any running timer callback to complete.
If a timer callback is executing when lbsfreeadapter() is called, the callback will access freed memory since lbscfgfree() frees the containing structure immediately after lbsfreeadapter() returns.
Both timer callbacks (lbscmdtimeouthandler and lbstxlockuphandler) access priv->driverlock, priv->curcmd, priv->dev, and other fields, which would all be use-after-free violations.
Use timerdeletesync() instead to ensure any running timer callback has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where deltimer() was used instead of deltimersync() in the cleanup path. The commandtimer has had the same issue since the driver was first written.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Use timer_delete_sync() for both command_timer and tx_lockup_timer in lbs_free_adapter() so any running timer callback completes before the containing structure is freed.
Linux kernel wifi: libertas timer cleanup in lbs_free_adapter() = timer_delete_sync()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23281?
CVE-2026-23281 has been classified as a critical vulnerability due to its potential to cause use-after-free errors in the Linux kernel.
How do I fix CVE-2026-23281?
To fix CVE-2026-23281, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-23281?
CVE-2026-23281 affects the Linux kernel specifically with the libertas driver.
What kind of attack could be executed using CVE-2026-23281?
An attacker could potentially exploit CVE-2026-23281 to execute arbitrary code in the context of the kernel, leading to system compromise.
Has CVE-2026-23281 been publicly disclosed?
Yes, CVE-2026-23281 has been publicly disclosed, and users are urged to apply the necessary updates to secure their systems.