CVE-2026-98194

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas_tf: fix UAF in lbtf_free_adapter()

lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command

buffers before calling timer_delete_sync() to wait for the command

timer callback. If the timer callback (command_timer_fn) is already

running when lbtf_free_cmd_buffer() frees the command array, the

callback dereferences priv->cur_cmd->cmdbuf which points to freed

memory.

Swap the order so that timer_delete_sync() runs first, ensuring any

in-flight callback has completed before the command buffers are freed.