SB20260325177 - Use After Free in Linux kernel marvell libertas driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260325177

SB20260325177 - Use After Free in Linux kernel marvell libertas driver

Published: March 25, 2026

Security Bulletin ID SB20260325177
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Use After Free (CVE-ID: CVE-2026-23281)

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in lbs_free_adapter() function in the Linux kernel's libertas Wi-Fi driver when handling timer cleanup during device adapter release. A local user can trigger the release of the adapter structure while timer callbacks are still executing, leading to access of freed memory and potential execution of arbitrary code or system crash.

Exploitation requires the ability to trigger device cleanup, which is typically available to users with access to network device interfaces.


Remediation

Install update from vendor's website.

References