CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertastf: fix use-after-free in lbtffreeadapter()
lbtffreeadapter() calls timerdelete(&priv->commandtimer), which does not wait for a running commandtimerfn() callback. lbtffreeadapter() runs on the teardown path right before ieee80211freehw() frees priv, both in lbtfremovecard() and in the probe error path. commandtimer is armed by modtimer() in lbtfcmd() whenever a firmware command is sent. commandtimerfn() dereferences priv. If a command times out as the device is removed, commandtimerfn() runs concurrently with teardown and dereferences priv after it has been freed.
This is the same use-after-free that commit 03cc8f90d053 ("wifi: libertas: fix use-after-free in lbsfreeadapter()") fixed in the sibling libertas driver. The libertastf variant has the identical pattern and was left unchanged. Use timerdeletesync() so any in-flight callback completes before priv is freed.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In lbtf_free_adapter(), replace timer_delete(&priv->command_timer) with timer_delete_sync(&priv->command_timer) so any in-flight command_timer_fn() callback completes before priv is freed.
Linux kernel (wifi: libertas_tf / libertas_tf driver) Use timer_delete_sync() instead of timer_delete() = timer_delete_sync(&priv->command_timer)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72070?
The severity of CVE-2026-72070 is rated at risk level 44.
What type of vulnerability is CVE-2026-72070?
CVE-2026-72070 is categorized as a Use After Free vulnerability.
How do I fix CVE-2026-72070?
To fix CVE-2026-72070, update the Linux kernel to a version that includes the patch for lbtf_free_adapter().
What impact does CVE-2026-72070 have on system security?
CVE-2026-72070 could potentially allow an attacker to execute arbitrary code or cause a denial of service.
Which component is affected by CVE-2026-72070?
CVE-2026-72070 affects the wifi driver component, specifically the libertas_tf module in the Linux kernel.