PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46069 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Marvell WiFi driver (mwifiex). The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) to cancel the wakeup_timer before the adapter structure is freed. Because timer_delete() does not wait for running timer callbacks to complete, the wakeup_timer_fn callback may continue executing and access adapter fields (adapter->hw_status, adapter->if_ops.card_reset) after the adapter has been freed by mwifiex_free_adapter() in the mwifiex_remove_card() path. The fix replaces timer_delete() with timer_delete_sync() to ensure any running timer callback completes before returning.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with Marvell WiFi hardware using the mwifiex kernel driver, particularly those in environments where WiFi adapters may be hot-removed or where driver unload operations occur frequently.

Technical summary

The mwifiex driver in the Linux kernel contains a race condition in its cleanup path. The mwifiex_adapter_cleanup() function calls timer_delete() on the wakeup_timer, which does not synchronize with any running timer callback. If wakeup_timer_fn is executing when the cleanup runs, it may access adapter structure fields after mwifiex_free_adapter() has freed the memory. The vulnerability is resolved by using timer_delete_sync() to ensure callback completion before returning.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46069 when available from your Linux distribution
  • Verify that systems using Marvell WiFi hardware (mwifiex driver) are running a patched kernel version
  • Monitor vendor security advisories for kernel package updates addressing this vulnerability
  • Consider disabling or removing mwifiex hardware if patching is not immediately feasible and the device is not required for operations

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix involves changing timer_delete() to timer_delete_sync() in mwifiex_adapter_cleanup(). Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Official resources

2026-05-27