CVE-2026-98196 wifi: brcmsmac: fix UAF in brcms_free_timer()
A use-after-free vulnerability in the Linux kernel's brcmsmac Wi-Fi driver allows attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98196?
CVE-2026-98196 is an use after free vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: fix UAF in brcms_free_timer()
brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of().
Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.
Which versions are affected by CVE-2026-98196?
How do I fix CVE-2026-98196?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98196 being exploited?
There is no known exploitation of CVE-2026-98196 in the wild and no public exploit code.
Sources
Also known as AZL-110494, BELL-CVE-2026-98196, DEBIAN-CVE-2026-98196, GHSA-mgv7-3mhx-9f53, UBUNTU-CVE-2026-98196.