CVE-2026-98196 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: fix UAF in brcms_free_timer()
brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of().
Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel vulnerability identified as a use-after-free issue within the brcmsmac wireless driver stems from improper synchronization during resource cleanup operations. Specifically, the function brcms_free_timer is responsible for releasing memory associated with a hardware timer object used by Broadcom Wi-Fi drivers. The core technical flaw lies in the sequence of calls made when freeing this structure. The implementation invokes brcms_del_timer to stop pending work items, which internally relies on cancel_delayed_work. This standard cancellation function operates asynchronously; it removes the work item from the kernel's execution queue but does not wait for a callback that is currently executing on another CPU core or interrupt context to finish. Consequently, if the timer callback function _brcms_timer happens to be running at the moment brcms_del_timer returns false indicating the work was already in progress, the subsequent call to kfree immediately deallocates the memory structure t.
This race condition creates a critical use-after-free scenario where the still-running callback continues to execute and attempts to access fields within the timer structure via container_of macros after that memory has been returned to the system allocator. Accessing freed memory leads to undefined behavior, which can manifest as kernel panics, data corruption, or potentially allow an attacker with local privileges to exploit this race condition for privilege escalation or denial of service attacks against the host system. The vulnerability highlights a common pitfall in concurrent programming within the Linux kernel where asynchronous cancellation functions are mistakenly used when synchronous completion is required before resource deallocation.
From a classification perspective, this flaw aligns with CWE-416 Use After Free, which describes situations where software continues to use memory after it has been freed, leading to unpredictable behavior and potential security breaches. In the context of the MITRE ATT&CK framework for enterprise environments, such kernel-level vulnerabilities are often leveraged in post-exploitation phases to achieve privilege escalation or persistence by gaining control over the operating system's execution flow through corrupted data structures. The impact is significant as it affects the stability and security of systems relying on Broadcom wireless hardware drivers within Linux distributions.
To mitigate this vulnerability, developers must ensure that any asynchronous work items are fully completed before their associated memory structures are released. The resolution involves modifying brcms_free_timer to call cancel_delayed_work_sync instead of or in addition to the non-synchronous variant after invoking brcms_del_timer. This synchronous function guarantees that if the delayed work was currently executing, it will wait for its completion before returning control to the caller. By enforcing this synchronization point, the kernel ensures that no thread holds a reference to the timer structure during the critical window between cancellation and deallocation. System administrators should apply available kernel updates or backported patches from their distribution vendors to resolve this issue in production environments running affected versions of the Linux kernel with brcmsmac drivers enabled.