PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46069 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Marvell WiFi driver (mwifiex). The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) to cancel the wakeup_timer before the adapter structure is freed. Because timer_delete() does not wait for running timer callbacks to complete, the wakeup_timer_fn callback may continue executing and access adapter fields (adapter->hw_status, adapter->if_ops.card_reset) after the adapter has been freed by mwifiex_free_adapter() in the mwifiex_remove_card() path. The fix replaces timer_delete() with timer_delete_sync() to ensure any running timer callback completes before returning.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with Marvell WiFi hardware using the mwifiex kernel driver, particularly those in environments where WiFi adapters may be hot-removed or where driver unload operations occur frequently.

Technical summary

The mwifiex driver in the Linux kernel contains a race condition in its cleanup path. The mwifiex_adapter_cleanup() function calls timer_delete() on the wakeup_timer, which does not synchronize with any running timer callback. If wakeup_timer_fn is executing when the cleanup runs, it may access adapter structure fields after mwifiex_free_adapter() has freed the memory. The vulnerability is resolved by using timer_delete_sync() to ensure callback completion before returning.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46069 when available from your Linux distribution
  • Verify that systems using Marvell WiFi hardware (mwifiex driver) are running a patched kernel version
  • Monitor vendor security advisories for kernel package updates addressing this vulnerability
  • Consider disabling or removing mwifiex hardware if patching is not immediately feasible and the device is not required for operations

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix involves changing timer_delete() to timer_delete_sync() in mwifiex_adapter_cleanup(). Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46069 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46069

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46069 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46069

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.