Unrated severityNVD Advisory· Published May 27, 2026· Updated May 27, 2026

CVE-2026-46069

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete.

If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path.

Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel mwifiex driver use-after-free in cleanup due to non-synchronous timer deletion, fixed by using timer_delete_sync().

Vulnerability

In the Linux kernel mwifiex driver, the function mwifiex_adapter_cleanup() uses timer_delete() (non-synchronous) to stop the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback (wakeup_timer_fn) to complete. If the callback is executing when mwifiex_adapter_cleanup() is called, it may continue to access adapter fields (e.g., adapter->hw_status, adapter->if_ops.card_reset) after they have been freed by mwifiex_free_adapter(). This affects all kernel versions using the mwifiex driver prior to the fix commit [1].

Exploitation

An attacker with local access or the ability to trigger the removal of a mwifiex network interface (e.g., via hot-plug or driver unbind) could exploit the race condition. The attacker would need to cause the wakeup_timer callback to execute concurrently with the cleanup path. No authentication is required beyond the ability to trigger the device removal. The race window is short, but exploitation could be achieved through precise timing [1].

Impact

Successful exploitation leads to a use-after-free condition, potentially resulting in memory corruption, system crash (denial of service), or arbitrary code execution in the kernel context. An attacker could leverage this to escalate privileges or compromise the system [1].

Mitigation

The vulnerability is fixed by commit 030abbae49cf9fd1fba7aa08e15ec81efbeb78cf in the Linux kernel stable tree, which replaces timer_delete() with timer_delete_sync() to ensure any running timer callback completes before the adapter structure is freed. Users should apply this patch or update to a kernel version containing it. No workaround is available [1].

References

Making sure you're not a bot!

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Linux/mwifiexllm-fuzzy
Ubuntu/Linux Kernelllm-fuzzy

Patches

11869ce402d9

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDaniel HodgesApr 30, 2026Fixed in 6.6.140via kernel-cna

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index c9c58419c37bfb..64d651c78570d9 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -386,7 +386,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index c9c58419c37bfb..64d651c78570d9 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -386,7 +386,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

63fe3389b3e0

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDaniel HodgesApr 30, 2026Fixed in 6.12.86via kernel-cna

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 8b61e45cd66781..4caf54954894d7 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -390,7 +390,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 8b61e45cd66781..4caf54954894d7 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -390,7 +390,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

030abbae49cf

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDaniel HodgesFixed in 7.0.4via kernel-cna

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

ae5e95d41574

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDaniel HodgesFixed in 7.1-rc1via kernel-cna

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

4e179a60a60c

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDaniel HodgesFixed in 6.18.27via kernel-cna

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 4820010a86f6b1..5902e2c821f28d 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 4820010a86f6b1..5902e2c821f28d 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

11869ce402d9

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDaniel HodgesApr 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index c9c58419c37bfb..64d651c78570d9 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -386,7 +386,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index c9c58419c37bfb..64d651c78570d9 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -386,7 +386,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

63fe3389b3e0

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDaniel HodgesApr 30, 2026via nvd-ref

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 8b61e45cd66781..4caf54954894d7 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -390,7 +390,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 8b61e45cd66781..4caf54954894d7 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -390,7 +390,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	del_timer(&adapter->wakeup_timer);
+	del_timer_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

ae5e95d41574

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDaniel Hodgesvia nvd-ref

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

4e179a60a60c

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDaniel Hodgesvia nvd-ref

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 4820010a86f6b1..5902e2c821f28d 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 4820010a86f6b1..5902e2c821f28d 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

030abbae49cf

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDaniel Hodgesvia nvd-ref

commit

2 files changed · +2 −4

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

drivers/net/wireless/marvell/mwifiex/init.c+1 −2 modified

diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 5c9a46e64d23c6..0c892501372480 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
 static void
 mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
-	timer_delete(&adapter->wakeup_timer);
+	timer_delete_sync(&adapter->wakeup_timer);
 	cancel_delayed_work_sync(&adapter->devdump_work);
 	mwifiex_cancel_all_pending_cmd(adapter);
 	wake_up_interruptible(&adapter->cmd_wait_q.wait);
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"Use of non-synchronous timer deletion (del_timer/timer_delete) instead of synchronous deletion (del_timer_sync/timer_delete_sync) allows a use-after-free when the timer callback accesses freed adapter memory."

Attack vector

An attacker who can trigger device removal (e.g., physically removing a mwifiex wireless card or triggering a driver unbind) while the `wakeup_timer_fn` callback is concurrently executing can cause a use-after-free. The non-synchronous `del_timer()` / `timer_delete()` in `mwifiex_adapter_cleanup()` does not wait for a running timer callback to finish [patch_id=2659975]. If the callback is still accessing `adapter` fields (such as `adapter->hw_status` or `adapter->if_ops.card_reset`) after `mwifiex_adapter_cleanup()` returns, those fields may be freed by `mwifiex_free_adapter()` later in the `mwifiex_remove_card()` path, leading to a use-after-free condition.

Affected code

The vulnerability is in `drivers/net/wireless/marvell/mwifiex/init.c` in the function `mwifiex_adapter_cleanup()`. The fault is the use of `del_timer()` / `timer_delete()` (non-synchronous) for `adapter->wakeup_timer` instead of the synchronous variant `del_timer_sync()` / `timer_delete_sync()` [patch_id=2659975].

What the fix does

The patch replaces `del_timer(&adapter->wakeup_timer)` with `del_timer_sync(&adapter->wakeup_timer)` (or `timer_delete_sync()` in the upstream commit) in `mwifiex_adapter_cleanup()` [patch_id=2659975]. Unlike `del_timer()` / `timer_delete()`, the synchronous variant blocks until any currently executing timer callback has finished. This ensures that `wakeup_timer_fn` cannot still be accessing `adapter` fields after `mwifiex_adapter_cleanup()` returns, preventing the use-after-free when `mwifiex_free_adapter()` subsequently frees the adapter structure.

Preconditions

inputThe attacker must be able to trigger device removal (e.g., physically remove the mwifiex wireless card or initiate a driver unbind) while the wakeup_timer callback is executing.
configThe wakeup_timer must have been armed and its callback (wakeup_timer_fn) must be running concurrently with mwifiex_adapter_cleanup().

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000