Use-after-free in Linux kernel - CVE-2026-98196

Vulnerability details

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.

The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().

Affected software

How to mitigate CVE-2026-98196

External References

• https://git.kernel.org/stable/c/050d2486e8ed2c0a23b87249ccd23e8072721391
• https://git.kernel.org/stable/c/10eeb0b29fd7f52487c9ae573e8d79c210a0095d
• https://git.kernel.org/stable/c/1edb3ddd261e973a4d577c0547e63bfa25a8170d
• https://git.kernel.org/stable/c/1eeca1d5e0920fbdad6449768fd2d4364e714180
• https://git.kernel.org/stable/c/2a4841ff0b74b495cddd31ae324e922217fc2f13
• https://git.kernel.org/stable/c/74acccc928851f69184271832d690607877122af
• https://git.kernel.org/stable/c/777cb6bba59e875b16a1d8897a483a5fecfcd5d2
• https://git.kernel.org/stable/c/856dabd5f2617efb23c043be9e1b22a9e6e97c41

Related Security Bulletins

• Use-after-free in Linux kernel brcm80211 brcmsmac driver
• Debian update for linux