CVE-2026-98196

A flaw was found in the Linux kernel's brcmsmac wireless driver. When a timer is released, the driver fails to wait for running background tasks associated with the timer to finish before freeing memory. A local attacker could exploit this race condition to trigger a use-after-free condition, leading to a system crash, denial of service (DoS), or potentially arbitrary code execution.

A race in brcms_free_timer() can cause use after free because brcms_del_timer() uses non synchronous delayed work cancellation and does not wait for an active _brcms_timer callback to finish. The timer structure can therefore be freed while the callback still derives and accesses the same object through container_of(). The confirmed impact is at least a local denial of service through a kernel crash. For the CVSS the PR:L value is used for the paranoid score because delegated network administration or a restricted service may be able to initiate interface lifecycle operations without having full host control. Triggering requires brcmsmac hardware and a narrow race between delayed work execution and timer teardown, so AC:H is appropriate. The issue is not directly network reachable. Remote wireless traffic may influence callback timing but is not known to be sufficient to free the timer object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.