What is CVE-2026-46069?

CVE-2026-46069 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 4.0 onward and patched in 5.10.259, 5.15.210, 6.1.176 and others. CVE-2026-46069 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-46069?

CVE-2026-46069 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-46069?

Yes, CVE-2026-46069 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.176 and others. If you are running Linux kernel 4.0 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-46069 actively exploited?

CVE-2026-46069 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2026-46069

High

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

Package Linux Kernel

Published 2026-05-27

Last modified 2026-06-24

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2026-46069 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 4.0 and later are affected. Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1 and their respective stable series.

Affected from

≥ 4.0

Fixed in

✓ 5.10.259 5.10.x ✓ 5.15.210 5.15.x ✓ 6.1.176 6.1.x ✓ 6.6.140 6.6.x ✓ 6.12.86 6.12.x ✓ 6.18.27 6.18.x ✓ 7.0.4 7.0.x ✓ 7.1

References

8 total

Kernel Git
https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf

Patch
Kernel Git
https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103

Patch
Kernel Git
https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812

Patch
Kernel Git
https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8

Patch
Kernel Git
https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-46069

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-05-27

Modified 2026-06-24

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-46069?

CVE-2026-46069 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 4.0 onward and has been patched in 5.10.259, 5.15.210, 6.1.176 and others. CVE-2026-46069 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-46069?

CVE-2026-46069 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-46069?

Yes. CVE-2026-46069 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.176 and others. If you are running Linux kernel 4.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-46069 actively exploited?

No. CVE-2026-46069 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.