Executive brief
A vulnerability was identified in the Linux kernel's Marvell Wi-Fi driver (mwifiex). The software incorrectly handles internal timers during hardware cleanup, which could allow a background task to access memory after it has been deleted. While primarily a stability issue that could cause system crashes, use-after-free vulnerabilities can sometimes be exploited to compromise system integrity or escalate privileges.
Technical details
A use-after-free vulnerability exists in the Linux kernel mwifiex Wi-Fi driver. The function mwifiex_adapter_cleanup() originally used timer_delete() (or del_timer() in older versions), which is non-synchronous and does not wait for active timer callbacks to finish. If wakeup_timer_fn is executing during cleanup, it may attempt to access adapter fields like hw_status or if_ops.card_reset after they have been deallocated by mwifiex_free_adapter(). This race condition is resolved by using timer_delete_sync() (or del_timer_sync()), ensuring all callbacks complete before memory is freed. The fix has been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel mwifiex driver
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
References
- https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf
- https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103
- https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8
- https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618
- https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb