CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: fix use-after-free in mwifiexadaptercleanup()
The mwifiexadaptercleanup() function uses timerdelete() (non-synchronous) for the wakeuptimer before the adapter structure is freed. This is incorrect because timerdelete() does not wait for any running timer callback to complete.
If the wakeuptimer callback (wakeuptimerfn) is executing when mwifiexadaptercleanup() is called, the callback will continue to access adapter fields (adapter->hwstatus, adapter->ifops.cardreset, etc.) which may be freed by mwifiexfreeadapter() called later in the mwifiexremovecard() path.
Use timerdeletesync() instead to ensure any running timer callback has completed before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Modify mwifiex_adapter_cleanup() to use timer_delete_sync() rather than timer_delete(), ensuring any running wakeup_timer_fn callback completes before mwifiex_adapter_cleanup() returns and before adapter fields are freed via mwifiex_free_adapter() / mwifiex_remove_card() path.
Linux kernel (wifi: mwifiex) Use timer_delete_sync() instead of timer_delete() in mwifiex_adapter_cleanup() = timer_delete_sync()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running a Linux kernel with the mwifiex Wi-Fi driver are exposed. The affected software list also includes Microsoft azl3 kernel 6.6.139.1-1.
What conditions are required to trigger the use-after-free?
The wakeup_timer callback must already be running when mwifiex_adapter_cleanup() is called during the card removal path. The non-synchronous timer deletion can then allow the callback to access adapter fields after the adapter has been freed.
What is the remediation?
Apply the kernel fix that replaces timer_delete() with timer_delete_sync() for the mwifiex wakeup_timer cleanup. This ensures any running callback completes before adapter cleanup proceeds.