CVE-2026-72070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()

lbtf_free_adapter() calls timer_delete(&priv->command_timer), which does

not wait for a running command_timer_fn() callback. lbtf_free_adapter()

runs on the teardown path right before ieee80211_free_hw() frees priv,

both in lbtf_remove_card() and in the probe error path. command_timer is

armed by mod_timer() in lbtf_cmd() whenever a firmware command is sent.

command_timer_fn() dereferences priv. If a command times out as the

device is removed, command_timer_fn() runs concurrently with teardown and

dereferences priv after it has been freed.

This is the same use-after-free that commit 03cc8f90d053 ("wifi: libertas:

fix use-after-free in lbs_free_adapter()") fixed in the sibling libertas

driver. The libertas_tf variant has the identical pattern and was left

unchanged. Use timer_delete_sync() so any in-flight callback completes

before priv is freed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References