All vulnerabilities
CVE-2026-98196

Linux: wifi: brcmsmac: fix UAF in brcms_free_timer()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10eeb0b29fd7f52487c9ae573e8d79c210a0095dAlso 74acccc928851f69184271832d690607877122af, 050d2486e8ed2c0a23b87249ccd23e8072721391 and 5 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 10eeb0b29fd7f52487c9ae573e8d79c210a0095dLinuxCVE List
  • 74acccc928851f69184271832d690607877122afLinuxCVE List
  • 050d2486e8ed2c0a23b87249ccd23e8072721391LinuxCVE List
  • 856dabd5f2617efb23c043be9e1b22a9e6e97c41LinuxCVE List
  • 2a4841ff0b74b495cddd31ae324e922217fc2f13LinuxCVE List
  • 1edb3ddd261e973a4d577c0547e63bfa25a8170dLinuxCVE List
Show all 8 fixed versions
  • 777cb6bba59e875b16a1d8897a483a5fecfcd5d2LinuxCVE List
  • 1eeca1d5e0920fbdad6449768fd2d4364e714180LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmsmac: fix UAF in brcms_free_timer()

brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of().

Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.

Text from CVE List

Affected versions 18

  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 10eeb0b29fd7f52487c9ae573e8d79c210a0095dCVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 74acccc928851f69184271832d690607877122afCVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 050d2486e8ed2c0a23b87249ccd23e8072721391CVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 856dabd5f2617efb23c043be9e1b22a9e6e97c41CVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 2a4841ff0b74b495cddd31ae324e922217fc2f13CVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 1edb3ddd261e973a4d577c0547e63bfa25a8170dCVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 777cb6bba59e875b16a1d8897a483a5fecfcd5d2CVE List
  • Linuxaffected: 5b435de0d786869c95d1962121af0d7df2542009 before 1eeca1d5e0920fbdad6449768fd2d4364e714180CVE List
  • Linuxaffected: 3.2CVE List
  • Linuxunaffected: all versions before 3.2CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8