CVE-2026-98194 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory.
Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel driver for Marvell Libertas TF wireless adapters contains a critical use-after-free vulnerability within its adapter cleanup routine. This flaw resides specifically in the lbtf_free_adapter function, which is responsible for releasing resources associated with the network device when it is being removed or reset. The root cause of this issue stems from an incorrect ordering of resource deallocation operations relative to asynchronous timer callbacks. Specifically, the original implementation invokes lbtf_free_cmd_buffer prior to calling timer_delete_sync. This sequence creates a race condition where command buffers are released while a hardware interrupt or scheduled task may still be executing code that relies on those same memory regions being valid and accessible.
The technical mechanism of this vulnerability involves the interaction between the driver's command processing logic and its internal watchdog timers. When a command is sent to the wireless adapter, it often triggers a timer callback function named command_timer_fn to handle timeouts or status updates. This callback accesses private data structures including priv->cur_cmd->cmdbuf, which points directly to the allocated command buffer memory. If lbtf_free_adapter frees this memory via lbtf_free_cmd_buffer before ensuring that any running timer callbacks have terminated through timer_delete_sync, the subsequent execution of the callback will attempt to dereference a pointer to already freed heap memory. This constitutes a classic use-after-free condition where the kernel continues to operate on deallocated resources, leading to undefined behavior and potential system instability.
The operational impact of this vulnerability is severe, as it can lead to kernel panics, data corruption, or arbitrary code execution depending on how the freed memory is subsequently allocated and used by other subsystems. An attacker with local access could potentially exploit this race condition during device removal or reset operations to trigger a denial of service against the entire system. In more sophisticated scenarios involving heap grooming techniques, such use-after-free flaws can be leveraged for privilege escalation, allowing an unprivileged user to gain root-level control over the host machine. The vulnerability highlights the critical importance of synchronization primitives in kernel drivers that manage asynchronous hardware interactions and timer-based state machines.
To mitigate this risk, the fix involves reordering the cleanup sequence within lbtf_free_adapter so that timer_delete_sync is executed before any memory deallocation occurs. This ensures that all pending or currently running timer callbacks have fully completed their execution contexts before the underlying command buffer memory is returned to the kernel allocator. By guaranteeing that no active references exist against the freed memory, the race condition is eliminated. Developers should adhere strictly to synchronization protocols when managing resources tied to asynchronous events in Linux kernel drivers. This incident aligns with CWE-416 which describes use-after-free errors and underscores the necessity of verifying callback completion states before resource release. It also relates to ATT&CK techniques involving exploitation for privilege escalation or denial of service through memory corruption vulnerabilities within operating system components.