CVE-2026-98196

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.

Is your site exposed to CVE-2026-98196?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/050d2486e8ed2c0a23b87249ccd23e8072721391 https://git.kernel.org/stable/c/10eeb0b29fd7f52487c9ae573e8d79c210a0095d https://git.kernel.org/stable/c/1edb3ddd261e973a4d577c0547e63bfa25a8170d https://git.kernel.org/stable/c/1eeca1d5e0920fbdad6449768fd2d4364e714180 https://git.kernel.org/stable/c/2a4841ff0b74b495cddd31ae324e922217fc2f13 https://git.kernel.org/stable/c/74acccc928851f69184271832d690607877122af https://git.kernel.org/stable/c/777cb6bba59e875b16a1d8897a483a5fecfcd5d2 https://git.kernel.org/stable/c/856dabd5f2617efb23c043be9e1b22a9e6e97c41

Frequently Asked Questions

What is CVE-2026-98196? +

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed.

How do I check if I'm vulnerable to CVE-2026-98196? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.