CVE Explorer

CVE-2026-23281

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() fr

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b8facee67ae6a19485434a15e230d4ef012e0a1d3a603abf6a7e635337221a11

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/marvell/libertas/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versi…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/marvell/libertas/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4","status":"affected","version":"954ee164f4f4598afc172c0ec3865d0352e55a0b","versionType":"git"},{"lessThan":"09f3c30ab3b1371eaf9676a1b8add57bca763083","status":"affected","version":"954ee164f4f4598afc172c0ec3865d0352e55a0b","versionType":"git"},{"lessThan":"3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc","status":"affected","version":"9…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/affected/0

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/09f3c30ab3b1371eaf9676a1b8add57bca763083"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/b15e0fa7adb4de3a03aee9e6fc4d83e5cf0a65e4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55c838e8460d99ccf868ce527f20472862cfd18ec25e8bdf3ab811a30393b9e9 · sha256:a04f9d756b91bda4… · /containers/cna/references/5

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer