Cloudanix VulnDB

CVE-2026-98194

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing mistake in how the Linux kernel cleans up wireless network commands could let an attacker crash the machine or gain elevated access.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the libertas_tf wireless driver where lbtf_free_adapter frees command buffers before timer_delete_sync, allowing command_timer_fn to dereference priv->cur_cmd->cmdbuf into freed memory.

Why it matters to the business

Systems using this driver face kernel crashes, potential privilege escalation, or denial of service; high prevalence of Linux in servers, embedded devices, and IoT increases operational risk and patch urgency.

How an attack unfolds

An attacker triggers repeated wifi command operations to race the timer callback against adapter teardown, causing the callback to access already-freed command buffers and achieve arbitrary kernel read/write or crash.

How to fix it

Update the Linux kernel to a version containing the corrected lbtf_free_adapter ordering that calls timer_delete_sync before lbtf_free_cmd_buffer; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patched source contains timer_delete_sync before the free call in lbtf_free_adapter; run kernel regression tests exercising adapter free paths under timer load and verify absence of UAF reports in KASAN or kernel logs.

Typical attack path

  1. Obtain local code execution on a system with the libertas_tf driver loaded
  2. Initiate wifi command sequences that arm the command timer
  3. Trigger adapter removal or interface teardown while the timer is pending
  4. Command callback executes after buffers are freed, dereferencing invalid memory

How to detect it

Inspect kernel logs for UAF reports referencing lbtf_free_adapter, command_timer_fn, or libertas_tf; correlate with wireless interface removal events; examine crash dumps for dereferences of freed command buffers.

What your security team should do

  • Prioritize kernel updates on all systems exposing the libertas_tf driver within the next maintenance window
  • Enable KASAN or similar memory debugging on test fleets to validate the fix
  • Audit wireless interface teardown code paths for similar ordering issues
  • Monitor vendor advisories for backported fixes in LTS kernels

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.

Affected packages

Ecosystem Package Introduced Fixed