CVE-2026-46069: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46069 Overview

CVE-2026-46069 is a use-after-free vulnerability in the Linux kernel's Marvell WiFi-Ex (mwifiex) driver. The flaw resides in the mwifiex_adapter_cleanup() function, which calls the non-synchronous timer_delete() on the wakeup_timer prior to freeing the adapter structure. If the wakeup_timer_fn callback is still executing during cleanup, it continues to dereference adapter fields such as adapter->hw_status and adapter->if_ops.card_reset after mwifiex_free_adapter() releases the memory. The fix replaces timer_delete() with timer_delete_sync() to guarantee the timer callback completes before the adapter is freed.

Critical Impact
A race between the wakeup timer callback and adapter teardown can lead to kernel memory corruption, potentially enabling denial of service or local privilege escalation on systems using Marvell wireless hardware.

Affected Products

Linux kernel versions containing the mwifiex driver prior to the fix commits
Systems using Marvell wireless adapters supported by mwifiex
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-05-27 - CVE-2026-46069 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46069

Vulnerability Analysis

The vulnerability is a classic use-after-free [CWE-416] race condition in the mwifiex wireless driver teardown path. When the kernel removes a Marvell wireless card, mwifiex_remove_card() invokes mwifiex_adapter_cleanup() to release driver state. That cleanup routine calls timer_delete() on the wakeup_timer, which only deactivates the timer if it is not currently running. The call returns immediately without waiting for an in-flight wakeup_timer_fn callback to finish.

Shortly after, mwifiex_free_adapter() frees the struct mwifiex_adapter allocation. If wakeup_timer_fn was already executing on another CPU when cleanup began, the callback continues to read and write through the freed adapter pointer, accessing fields including adapter->hw_status and the adapter->if_ops.card_reset function pointer.

Root Cause

The root cause is the use of an asynchronous timer cancellation primitive in a teardown path that requires synchronous semantics. timer_delete() cancels future executions but does not synchronize with a callback already running. Freeing the adapter immediately after this call creates a window where the timer callback dereferences released memory.

Attack Vector

The race triggers during driver removal or device disconnect events. An attacker with the ability to induce rapid bring-up and teardown of the Marvell wireless adapter, or to coincide adapter removal with timer expiration, can drive the race. Exploitation of the freed function pointer adapter->if_ops.card_reset could redirect kernel control flow if the freed memory is reallocated with attacker-controlled content.

The upstream fix replaces timer_delete() with timer_delete_sync(), which blocks until any executing instance of the timer callback completes before returning. This eliminates the window in which the callback can touch freed memory. See the Linux Kernel Commit 030abbae for the patch.

Detection Methods for CVE-2026-46069

Indicators of Compromise

Kernel oops or panic messages referencing mwifiex_adapter_cleanup, wakeup_timer_fn, or mwifiex_free_adapter in dmesg and /var/log/kern.log
KASAN use-after-free reports naming the mwifiex module and the wakeup_timer callback
Unexpected wireless interface disappearance followed by kernel stack traces during module unload or device hot-unplug

Detection Strategies

Enable KASAN and lockdep on test kernels to catch the race during driver load/unload cycles
Inventory hosts loading the mwifiex, mwifiex_pcie, mwifiex_sdio, or mwifiex_usb modules with lsmod and compare kernel versions against the fix commits
Review crash telemetry for repeating panics involving the wireless subsystem on affected hardware

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on stack traces containing mwifiex symbols
Monitor module load and unload events via auditd rules on init_module and delete_module syscalls
Track wireless interface state transitions on endpoints with Marvell adapters to identify abnormal teardown sequences

How to Mitigate CVE-2026-46069

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and reboot affected systems
If patching is not immediately possible, unload the mwifiex driver on systems that do not require Marvell wireless functionality using modprobe -r mwifiex
Restrict physical and local access to systems with Marvell wireless hardware until the kernel is updated

Patch Information

The fix replaces timer_delete() with timer_delete_sync() in mwifiex_adapter_cleanup(). The patch has been applied across multiple stable branches. Refer to the upstream commits: 030abbae, 11869ce4, 4e179a6, 63fe3389, and ae5e95d4. Pull the latest stable kernel from your distribution that incorporates these commits.

Workarounds

Blacklist the mwifiex family of modules on systems where Marvell wireless is unused by adding entries to /etc/modprobe.d/blacklist-mwifiex.conf
Disable hot-plug events for affected wireless devices to reduce the frequency of driver teardown operations
Avoid repeated rmmod/modprobe cycles of the mwifiex module on production endpoints until patched

bash

# Blacklist mwifiex modules until the kernel is patched
echo 'blacklist mwifiex' | sudo tee /etc/modprobe.d/blacklist-mwifiex.conf
echo 'blacklist mwifiex_pcie' | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
echo 'blacklist mwifiex_sdio' | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
echo 'blacklist mwifiex_usb' | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
sudo modprobe -r mwifiex_pcie mwifiex_sdio mwifiex_usb mwifiex
sudo update-initramfs -u