CVE-2026-46069 Details
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
A use-after-free vulnerability has been identified in the Linux kernel's mwifiex wireless driver. The issue arises in the mwifiex_adapter_cleanup() function, which improperly uses a non-synchronous timer deletion method. This can lead to a scenario where the timer's callback function accesses adapter fields that have already been freed, causing potential instability or exploitation. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed by changing the timer deletion method to a synchronous version, ensuring that any running timer callbacks have completed before the adapter structure is freed. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf | kernel.org | Patch |
| https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d | kernel.org | Patch |
| https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb | kernel.org | Patch |
| https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.0, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.176 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |