{"apiVersion":"1.0","identifier":"CVE-2026-72070","description":"In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() lbtf_free_adapter() calls timer_delete(&priv->command_timer), which does not wait for a running command_timer_fn() callback. lbtf_free_adapter() runs on the teardown path right before ieee80211_free_hw() frees priv, both in lbtf_remove_card() and in the probe error path. command_timer is armed by mod_timer() in lbtf_cmd() whenever a firmware command is sent. command_timer_fn() dereferences priv. If a command times out as the device is removed, command_timer_fn() runs concurrently with teardown and dereferences priv after it has been freed. This is the same use-after-free that commit 03cc8f90d053 (-wifi: libertas: fix use-after-free in lbs_free_adapter()-) fixed in the sibling libertas driver. The libertas_tf variant has the identical pattern and was left unchanged. Use timer_delete_sync() so any in-flight callback completes before priv is freed.","publishedAt":"2026-08-15T06:21:16","lastModifiedAt":"2026-08-23T13:16:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72070","cvssScore":null,"cvssVector":"Pending","epssProbability":0.0022,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72070","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72070","en":"https://www.redsauce.net/en/cves/CVE-2026-72070","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72070","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72070","de":"https://www.redsauce.net/de/cves/CVE-2026-72070","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72070","el":"https://www.redsauce.net/el/cves/CVE-2026-72070"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72070"}}