CVE-2026-23281

Root Cause The lbs_free_adapter() function in the libertas WiFi driver used timer_delete() (non-synchronous) to cancel command_timer and tx_lockup_timer before freeing the containing structure via lbs_cfg_free(). Because timer_delete() does not wait for a running callback to finish, a concurrently executing timer callback could access freed memory, leading to a use-after-free vulnerability [1].

Exploitation An attacker able to trigger device removal (e.g., via hot-unplug or module removal) while either timer is executing can cause the callbacks lbs_cmd_timeout_handler or lbs_tx_lockup_handler to dereference freed pointers such as priv->driver_lock, priv->cur_cmd, or priv->dev. Local access or crafted wireless conditions may be required to align timer execution with deallocation [2].

Impact Successful exploitation results in a use-after-free condition, which can lead to memory corruption, denial of service, or potential privilege escalation in a kernel context [3].

Mitigation The fix replaces timer_delete() with timer_delete_sync(), ensuring any running timer callback completes before the structure is freed. The patch has been backported to stable kernel trees [4]. Users should apply the latest kernel updates to mitigate this vulnerability.