CVE-2026-23281: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23281 Overview

A use-after-free vulnerability has been identified in the Linux kernel's Libertas WiFi driver within the lbs_free_adapter() function. The vulnerability occurs due to improper timer deletion handling during the adapter cleanup process. The function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before freeing the associated memory structure, which can lead to accessing freed memory if a timer callback is still executing.

Critical Impact
If a timer callback (lbs_cmd_timeout_handler or lbs_tx_lockup_handler) is executing when lbs_free_adapter() is called, the callback will access freed memory after lbs_cfg_free() frees the containing structure, resulting in use-after-free violations affecting priv->driver_lock, priv->cur_cmd, priv->dev, and other critical fields.

Affected Products

Linux Kernel (Libertas WiFi Driver)
Systems using Marvell Libertas-based WiFi adapters
Various Linux kernel stable branches

Discovery Timeline

2026-03-25 - CVE CVE-2026-23281 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23281

Vulnerability Analysis

This use-after-free vulnerability exists in the Libertas WiFi driver's adapter cleanup path. The root issue lies in the difference between timer_delete() and timer_delete_sync() functions. When lbs_free_adapter() is called, it attempts to cancel two active timers: command_timer and tx_lockup_timer. However, using timer_delete() does not guarantee that any currently executing timer callback has completed before returning.

The race condition window exists between the timer callback accessing various private structure fields (priv->driver_lock, priv->cur_cmd, priv->dev) and the subsequent call to lbs_cfg_free() which deallocates the containing structure. If the timer callback is mid-execution when the memory is freed, subsequent accesses within the callback will reference freed memory, potentially leading to kernel crashes, memory corruption, or exploitation scenarios.

Root Cause

The vulnerability was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had this same synchronization issue since the driver was first written. The correct fix requires using timer_delete_sync() (or del_timer_sync()) to ensure any running timer callback has completed before the function returns and memory deallocation proceeds.

Attack Vector

The attack vector for this vulnerability involves triggering a race condition during the WiFi adapter cleanup process. An attacker would need to:

Initiate adapter removal or driver unload while timer callbacks are active
Time the attack to ensure timer callbacks are executing during the cleanup window
Exploit the use-after-free condition when the callback accesses deallocated memory

The vulnerability requires local access and specific timing conditions to exploit. The timer callbacks access critical kernel structures including priv->driver_lock (spinlock), priv->cur_cmd (current command pointer), and priv->dev (network device pointer). Corrupting these during a use-after-free could allow kernel memory manipulation.

The fix replaces the non-synchronous timer_delete() calls with synchronous timer_delete_sync() calls, ensuring all timer callbacks have completed execution before memory deallocation occurs.

Detection Methods for CVE-2026-23281

Indicators of Compromise

Kernel oops or panic messages referencing the Libertas driver (lbs_cmd_timeout_handler or lbs_tx_lockup_handler)
KASAN (Kernel Address Sanitizer) reports indicating use-after-free in Libertas driver code
Unexpected system crashes during WiFi adapter removal or driver unload operations
Memory corruption indicators in kernel logs near Libertas WiFi driver code paths

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) to detect use-after-free violations at runtime
Monitor kernel logs for Libertas driver-related crashes or warnings during adapter cleanup
Implement kernel debugging with CONFIG_DEBUG_TIMERS to identify timer synchronization issues
Use static analysis tools to audit timer deletion patterns in kernel drivers

Monitoring Recommendations

Configure syslog monitoring for kernel panic and oops messages related to Libertas driver
Deploy kernel crash dump analysis to identify potential exploitation attempts
Monitor for unusual WiFi adapter removal patterns that could indicate exploitation attempts

How to Mitigate CVE-2026-23281

Immediate Actions Required

Update to a patched Linux kernel version containing the synchronous timer deletion fix
If immediate patching is not possible, avoid unloading the Libertas WiFi driver module on affected systems
Review systems using Marvell Libertas-based WiFi adapters for potential exposure
Monitor kernel logs for any signs of timer-related crashes in the Libertas driver

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix replaces timer_delete() calls with timer_delete_sync() in the lbs_free_adapter() function to ensure proper synchronization during cleanup. Patches are available through the following kernel git commits:

Workarounds

Avoid removing or unloading the Libertas WiFi driver module (libertas) while the system is under load
Blacklist the Libertas driver module on systems where this WiFi hardware is not actively used
Consider using alternative WiFi adapters that do not rely on the vulnerable Libertas driver

bash

# Blacklist the Libertas driver if not needed
echo "blacklist libertas" >> /etc/modprobe.d/blacklist-libertas.conf
echo "blacklist libertas_sdio" >> /etc/modprobe.d/blacklist-libertas.conf
echo "blacklist libertas_spi" >> /etc/modprobe.d/blacklist-libertas.conf
update-initramfs -u