CVE-2026-46069

CVEs › CVE-2026-46069

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Effective score: 7.1 / 10 HIGH source: CNA overview
MSRC score: 7.1 / 10 HIGH MS rating: Moderate
CWE(s): —
Reserved: 2026-05-13
Published: 2026-05-27 12:57 UTC
Last updated: 2026-05-27 12:57 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46069.json
Linked Threat: CVE-2026-46069 — CVE-2026-46069

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-27 14:17:28 UTC
NVD last modified: 2026-06-24 17:03:45 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0014 (probability of exploitation in next 30 days)
EPSS percentile: 3.74% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01

NVD-assigned CWE(s): CWE-416 (differs from the CNA list above)

NVD / KEV / EPSS data refreshed 2026-08-01 17:10 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-32451
Assigner: Linux
Published: May 27, 2026, 12:57:50 PM
Updated: Jun 19, 2026, 11:59:16 AM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.1400
Vendors: Linux
Products: Linux (patch: 7.1)

Linux (patch: 6.1.176)

Linux (patch: 6.12.86)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <ae5e95d4157481693be2317e3ffcd84e36010cbb)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <63fe3389b3e092d6c0eeea9fc0318e7918b16618)

Linux (patch: 6.18.27)

Linux (patch: 7.0.4)

Linux (patch: 5.15.210)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <11869ce402d95519d49b25a2a97741f68d69d103)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <c3508895450cca4aeaf5dbadbb5e582363005264)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <030abbae49cf9fd1fba7aa08e15ec81efbeb78cf)

Linux (4.0)

Linux (patch: 5.10.259)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <a88f5391dc68f78cae5eb6a8cd341cafee795d3d)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <4e179a60a60c0a5aea245e8e67768343c0f070b8)

Linux (patch: 0)

Linux (patch: 6.6.140)

Linux (4636187da60b6e33526050235c610409d9cc00e8 <1958a92599b2653d730ccb6f5685fc3fbed21812)
Aliases: GHSA-q36x-5cv4-59hh

ENISA description: In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

EUVD references (8)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:09 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 7.1 / 10 (temporal 6.5)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:U
Release: 2026-May

Microsoft remediations / KB articles (2)

CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 6.6.141.1-1)
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`4636187da60b6e33526050235c610409d9cc00e8` (affected), `4636187da60b6e33526050235c610409d9cc00e8` (affected), `4636187da60b6e33526050235c610409d9cc00e8` (affected), `4636187da60b6e33526050235c610409d9cc00e8` (affected), `4636187da60b6e33526050235c610409d9cc00e8` (affected)	—
Linux	Linux	`4.0` (affected), `0` (unaffected), `6.6.140` (unaffected), `6.12.86` (unaffected), `6.18.27` (unaffected), `7.0.4` (unaffected), `7.1-rc1` (unaffected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

MSRC update guide: CVE-2026-46069 msrc
None Available msrc
https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8 tenable:git.kernel.org
https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618 tenable:git.kernel.org
https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb tenable:git.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2026-46069 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-46069 tenable:www.cve.org
https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf tenable:git.kernel.org
https://www.first.org/epss/ tenable:www.first.org
https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103 tenable:git.kernel.org

NVD-tagged references (8)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-41089 Netlogon RCE: Patch Domain Controllers

web:blog.gridinsoft.com

CVE - 2026 -41089 in Windows Netlogon is now reported as actively exploited. Patch domain controllers and check LSASS, Netlogon, and authentication logs.

2026-06-04 00:12 UTC
Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

web:blog.qualys.com

May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

2026-06-04 00:12 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-04 00:12 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-06-04 00:12 UTC
Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...

web:support.servicenow.com

Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

2026-06-04 00:12 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-06-04 00:12 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

Oracle Critical Patch Update Advisory - April 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch ...

2026-06-04 00:12 UTC
Quantifying 2026 Routinely Targeted Vulnerabilities (So Far)

web:www.vulncheck.com

VulnCheck identified 25 CVEs disclosed in 2026 that have been routinely targeted by adversaries and researchers so far this year, drawing from a global body of exploit code and exploitation data.

2026-06-04 00:12 UTC
"This update broke BitLocker for me" — Windows 11's April patch is ...

web:www.windowscentral.com

A faulty BitLocker configuration is forcing some PCs into BitLocker recovery mode after the April 2026 update, but there's a workaround to resolve this issue.

2026-06-04 00:12 UTC
Patch Tuesday June 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-06-04 00:12 UTC
CVE-2026-40369: Windows Kernel Privilege Escalation Vulnerability ...

web:integsec.com

C — Mitigation & Remediation 1. Immediate (0-24h): Apply the official May 2026 Microsoft cumulative update for affected Windows 11 and Server 2025 versions via Windows Update, WSUS, or SCCM. Prioritize servers, developer workstations, and multi-user systems. Reboot required. 2.

2026-06-19 02:28 UTC
Windows 11, version 25H2 known issues and notifications

web:learn.microsoft.com

Windows 11, version 25H2 is now available for all eligible devices. Devices running Home and Pro editions of Windows 11 that are not managed by IT departments will receive the update to Windows 11, version 25H2 through the machine learning-based intelligent rollout.

2026-06-19 02:28 UTC
Security Update Guide - Loading - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-06-19 02:28 UTC
May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

2026-06-19 02:28 UTC
Microsoft Patch Tuesday - May 2026 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday May 2026 summary.

2026-06-19 02:28 UTC
Patch Tuesday: May 2026 Latest Patch Updates & Breakdown

web:www.manageengine.com

Unfold what this Patch Tuesday has in store for you Patch Tuesday, the unofficial term for Microsoft's scheduled security fix release on every second Tuesday of a month, has been a constant topic of discussion ever since its inception. Upcoming Webinar June 11,2026 11:30 EDT & 6:30 a.m. GMT Agenda of the Free Patch Tuesday webinar A complete breakdown of all the latest Patch Tuesday updates ...

2026-06-19 02:28 UTC
Oracle Critical Security Patch Update Advisory - May 2026

web:www.oracle.com

This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

2026-06-19 02:28 UTC
Patch Tuesday - June 2026 - Rapid7

web:www.rapid7.com

Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.

2026-06-19 02:28 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46069.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11869ce402d95519d49b25a2a97741f68d69d103",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "63fe3389b3e092d6c0eeea9fc0318e7918b16618",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "4e179a60a60c0a5aea245e8e67768343c0f070b8",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "030abbae49cf9fd1fba7aa08e15ec81efbeb78cf",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "ae5e95d4157481693be2317e3ffcd84e36010cbb",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter->hw_status, adapter->if_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:57:50.213Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103"
        },
        {
          "url": "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb"
        }
      ],
      "title": "wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46069",
    "datePublished": "2026-05-27T12:57:50.213Z",
    "dateReserved": "2026-05-13T15:03:33.095Z",
    "dateUpdated": "2026-05-27T12:57:50.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}