Junglewise Threat Intelligence

CVE-2026-23281: Linux Kernel Libertas Wi-Fi driver use-after-free in lbs_free_adapter

CVE-2026-23281 · Severity: high · CVSS 7.8 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Libertas Wi-Fi driver, which is used to support certain Marvell wireless network adapters. A flaw in how the driver shuts down can lead to a system crash or potentially allow unauthorized access to sensitive memory. This occurs because the system may attempt to run background tasks related to the Wi-Fi card after the memory for those tasks has already been cleared.

Technical details

A use-after-free (UAF) vulnerability exists in the lbs_free_adapter() function within the Libertas Wi-Fi driver (drivers/net/wireless/marvell/libertas/main.c). The root cause is the use of non-synchronous timer deletion functions (timer_delete or del_timer) for command_timer and tx_lockup_timer. These functions do not wait for active timer callbacks to finish before the underlying data structure is freed by lbs_cfg_free(). If a callback (lbs_cmd_timeout_handler or lbs_tx_lockup_handler) executes during or after the free operation, it accesses stale pointers to driver_lock, cur_cmd, and dev. This can be exploited by a local user to cause a kernel panic or achieve privilege escalation. The fix replaces these calls with timer_delete_sync() to ensure all callbacks complete before memory deallocation.

Affected products

  • Linux Linux Kernel 2.6.24 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2026-03-25: disclosed: Initial disclosure of the vulnerability and fix in the Linux kernel stable tree.
  • 2026-03-25: advisory: CVE-2026-23281 published.

References

Related threats