CVE-2026-23281: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23281 Overview

A use-after-free vulnerability has been identified in the Linux kernel's Libertas WiFi driver within the lbs_free_adapter() function. The vulnerability occurs due to improper timer deletion handling during the adapter cleanup process. The function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before freeing the associated memory structure, which can lead to accessing freed memory if a timer callback is still executing.

Critical Impact

If a timer callback (lbs_cmd_timeout_handler or lbs_tx_lockup_handler) is executing when lbs_free_adapter() is called, the callback will access freed memory after lbs_cfg_free() frees the containing structure, resulting in use-after-free violations affecting priv->driver_lock, priv->cur_cmd, priv->dev, and other critical fields.

Affected Products

• Linux Kernel (Libertas WiFi Driver)
• Systems using Marvell Libertas-based WiFi adapters
• Various Linux kernel stable branches

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23281 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23281

Vulnerability Analysis

This use-after-free vulnerability exists in the Libertas WiFi driver's adapter cleanup path. The root issue lies in the difference between timer_delete() and timer_delete_sync() functions. When lbs_free_adapter() is called, it attempts to cancel two active timers: command_timer and tx_lockup_timer. However, using timer_delete() does not guarantee that any currently executing timer callback has completed before returning.

The race condition window exists between the timer callback accessing various private structure fields (priv->driver_lock, priv->cur_cmd, priv->dev) and the subsequent call to lbs_cfg_free() which deallocates the containing structure. If the timer callback is mid-execution when the memory is freed, subsequent accesses within the callback will reference freed memory, potentially leading to kernel crashes, memory corruption, or exploitation scenarios.

Root Cause

The vulnerability was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had this same synchronization issue since the driver was first written. The correct fix requires using timer_delete_sync() (or del_timer_sync()) to ensure any running timer callback has completed before the function returns and memory deallocation proceeds.

Attack Vector

The attack vector for this vulnerability involves triggering a race condition during the WiFi adapter cleanup process. An attacker would need to:

1. Initiate adapter removal or driver unload while timer callbacks are active
2. Time the attack to ensure timer callbacks are executing during the cleanup window
3. Exploit the use-after-free condition when the callback accesses deallocated memory

The vulnerability requires local access and specific timing conditions to exploit. The timer callbacks access critical kernel structures including priv->driver_lock (spinlock), priv->cur_cmd (current command pointer), and priv->dev (network device pointer). Corrupting these during a use-after-free could allow kernel memory manipulation.

The fix replaces the non-synchronous timer_delete() calls with synchronous timer_delete_sync() calls, ensuring all timer callbacks have completed execution before memory deallocation occurs.

Detection Methods for CVE-2026-23281

Indicators of Compromise

• Kernel oops or panic messages referencing the Libertas driver (lbs_cmd_timeout_handler or lbs_tx_lockup_handler)
• KASAN (Kernel Address Sanitizer) reports indicating use-after-free in Libertas driver code
• Unexpected system crashes during WiFi adapter removal or driver unload operations
• Memory corruption indicators in kernel logs near Libertas WiFi driver code paths

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) to detect use-after-free violations at runtime
• Monitor kernel logs for Libertas driver-related crashes or warnings during adapter cleanup
• Implement kernel debugging with CONFIG_DEBUG_TIMERS to identify timer synchronization issues
• Use static analysis tools to audit timer deletion patterns in kernel drivers

Monitoring Recommendations

• Configure syslog monitoring for kernel panic and oops messages related to Libertas driver
• Deploy kernel crash dump analysis to identify potential exploitation attempts
• Monitor for unusual WiFi adapter removal patterns that could indicate exploitation attempts

How to Mitigate CVE-2026-23281

Immediate Actions Required

• Update to a patched Linux kernel version containing the synchronous timer deletion fix
• If immediate patching is not possible, avoid unloading the Libertas WiFi driver module on affected systems
• Review systems using Marvell Libertas-based WiFi adapters for potential exposure
• Monitor kernel logs for any signs of timer-related crashes in the Libertas driver

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix replaces timer_delete() calls with timer_delete_sync() in the lbs_free_adapter() function to ensure proper synchronization during cleanup. Patches are available through the following kernel git commits:

• Kernel Git Commit 03cc8f90d053
• Kernel Git Commit 3c5c818c78b0
• Kernel Git Commit 3f9dec4a6d95
• Kernel Git Commit a9f55b14486
• Kernel Git Commit d0155fe68f31
• Kernel Git Commit ed7d30f90b77

Workarounds

• Avoid removing or unloading the Libertas WiFi driver module (libertas) while the system is under load
• Blacklist the Libertas driver module on systems where this WiFi hardware is not actively used
• Consider using alternative WiFi adapters that do not rely on the vulnerable Libertas driver

# Blacklist the Libertas driver if not needed
echo "blacklist libertas" >> /etc/modprobe.d/blacklist-libertas.conf
echo "blacklist libertas_sdio" >> /etc/modprobe.d/blacklist-libertas.conf
echo "blacklist libertas_spi" >> /etc/modprobe.d/blacklist-libertas.conf
update-initramfs -u