CVE-2026-98196: wifi: brcmsmac: fix UAF in brcms_free_timer()
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: fix UAF in brcmsfreetimer()
brcmsfreetimer() calls brcmsdeltimer() which uses the non-synchronous canceldelayedwork() to cancel the timer's underlying delayed work. If the work callback (brcmstimer) is already running, canceldelayedwork() returns false without waiting, and brcmsfreetimer() proceeds to kfree(t) while the callback still accesses t through containerof().
Add an explicit canceldelayedworksync() after brcmsdeltimer() to guarantee that any in-flight callback has completed before the timer structure is freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In brcms_free_timer(), call cancel_delayed_work_sync() after brcms_del_timer() so any in-flight _brcms_timer callback completes before the timer structure is freed.
Event History
Frequently Asked Questions
When does the use-after-free condition occur?
It occurs when brcms_free_timer() frees a timer structure while its delayed-work callback, _brcms_timer, is already running. The non-synchronous cancellation can return without waiting for that callback, which continues to access the freed timer structure.
What change resolves the race?
The fix performs cancel_delayed_work_sync() after brcms_del_timer(). This ensures any in-progress delayed-work callback has finished before the timer structure is freed.