CVE-2026-98194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas_tf: fix UAF in lbtf_free_adapter()

lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command

buffers before calling timer_delete_sync() to wait for the command

timer callback. If the timer callback (command_timer_fn) is already

running when lbtf_free_cmd_buffer() frees the command array, the

callback dereferences priv->cur_cmd->cmdbuf which points to freed

memory.

Swap the order so that timer_delete_sync() runs first, ensuring any

in-flight callback has completed before the command buffers are freed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References