CVE-2026-72070

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertastf: fix use-after-free in lbtffree_adapter()

lbtffreeadapter() calls timerdelete(&priv->commandtimer), which does not wait for a running commandtimerfn() callback. lbtffreeadapter() runs on the teardown path right before ieee80211freehw() frees priv, both in lbtfremovecard() and in the probe error path. commandtimer is armed by modtimer() in lbtfcmd() whenever a firmware command is sent. commandtimerfn() dereferences priv. If a command times out as the device is removed, commandtimer_fn() runs concurrently with teardown and dereferences priv after it has been freed.

This is the same use-after-free that commit 03cc8f90d053 ("wifi: libertas: fix use-after-free in lbsfreeadapter()") fixed in the sibling libertas driver. The libertastf variant has the identical pattern and was left unchanged. Use timerdelete_sync() so any in-flight callback completes before priv is freed.