CVE-2026-72070

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the libertas tf wifi driver. The lbtf free adapter() function uses timer delete() for the command timer, which fails to wait for any active command timer fn() callbacks. Because lbtf free adapter() is executed during the teardown process immediately before ieee80211 free hw() frees the priv structure, a race condition occurs. If a firmware command times out while the device is being removed, the command timer fn() function may execute concurrently with the teardown and attempt to dereference the priv structure after it has been released from memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.