CVE-2026-98194: wifi: libertas_tf: fix UAF in lbtf_free_adapter()
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertastf: fix UAF in lbtffreeadapter()
lbtffreeadapter() calls lbtffreecmdbuffer() to free the command buffers before calling timerdeletesync() to wait for the command timer callback. If the timer callback (commandtimerfn) is already running when lbtffreecmdbuffer() frees the command array, the callback dereferences priv->curcmd->cmdbuf which points to freed memory.
Swap the order so that timerdeletesync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.
Affected Software
Event History
Frequently Asked Questions
What condition is required for the use-after-free to occur?
The command timer callback, command_timer_fn, must already be running while lbtf_free_adapter() frees the command buffers. The callback can then dereference priv->cur_cmd->cmdbuf after that memory has been freed.
When is the affected code path reached?
The issue is in the adapter teardown path in lbtf_free_adapter(). It is triggered by a race between freeing command buffers and synchronization with the command timer callback.
What does the fix change?
The fix runs timer_delete_sync() before freeing the command buffers. This waits for any in-flight command timer callback to finish before the callback can access command-buffer memory.