In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas tf: fix UAF in lbtf free adapter()

lbtf free adapter() calls lbtf free cmd buffer() to free the command buffers before calling timer delete sync() to wait for the command timer callback. If the timer callback (command timer fn) is already running when lbtf free cmd buffer() frees the command array, the callback dereferences priv->cur cmd->cmdbuf which points to freed memory.

Swap the order so that timer delete sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.