CVE-2026-98194
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer callback. If the timer callback (command_timer_fn) is already running when lbtf_free_cmd_buffer() frees the command array, the callback dereferences priv->cur_cmd->cmdbuf which points to freed memory. Swap the order so that timer_delete_sync() runs first, ensuring any in-flight callback has completed before the command buffers are freed.
Affected versions
Linux kernel versions
2.6.28
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98194?
CVE-2026-98194 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.28 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98194 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98194?
Yes. CVE-2026-98194 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 2.6.28 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98194 actively exploited?
No. CVE-2026-98194 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.