Linux Kernel EUVD-2026-32451

Vendor-released patch: update to a fixed Linux stable release - 6.6.140, 6.12.86, 6.18.27, 7.0.4, or 7.1-rc1 or later for your kernel branch; the fix replaces timer_delete() with timer_delete_sync() in mwifiex_adapter_cleanup(). Apply your distribution's kernel update once it incorporates the corresponding stable commit (see https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf and the sibling commits listed in the references). If immediate patching is not possible, a practical compensating control is to avoid loading the vulnerable driver where it is not needed - blacklist the mwifiex module (e.g., via modprobe blacklist) on systems that do not use Marvell Wi-Fi, which fully removes the attack surface at the cost of disabling that Wi-Fi hardware; on systems that require the driver, restrict the local privileges needed to trigger device removal/unbind and rmmod to trusted administrators to reduce who can race the teardown path.