CVE-2026-98194
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.
INFO
Published Date :
Oct. 6, 2026, 9:18 a.m.
Last Modified :
Oct. 19, 2026, 10:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to include the fix.
- Ensure timer_delete_sync() runs before freeing command buffers.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-98194.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-98194 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-98194
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-98194 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-98194 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 19, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98194.json">CVE-2026-98194</a> -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 06, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98194.json">CVE-2026-98194</a> Added Reference https://git.kernel.org/stable/c/04c837d413dc11a91e0275b08b9e35a6c111175e Added Reference https://git.kernel.org/stable/c/2b99bfc5a127ce8cd6a887d82815fc2e712f365b Added Reference https://git.kernel.org/stable/c/3fb3663260ec396f86b733aab9f81fac6669d2fa Added Reference https://git.kernel.org/stable/c/41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46 Added Reference https://git.kernel.org/stable/c/b4745d6063758c681d33affca9733bbd356b6ea1 Added Reference https://git.kernel.org/stable/c/bbb9a0ab96d44a64529aafc7a16de460a1712f6a Added Reference https://git.kernel.org/stable/c/e82536aad653e27c8ca7a8e0f6f816bc3f853ec3 Added Reference https://git.kernel.org/stable/c/f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6