In the Linux kernel, the following vulnerability has been resolved:

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

wcn36xx dxe deinit() tears down the TX ack timer with timer delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free irq() calls synchronize the interrupt handlers only. The callback, wcn36xx dxe tx timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211 hw in wcn36xx remove(): it takes wcn->dxe lock, reads wcn->tx ack skb and passes wcn->hw to ieee80211 tx status irqsafe().

Fix this by using timer shutdown sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx dxe init() on the next start, so the start/stop cycle is unaffected.

This issue was found by an in-house static analysis tool.