CVE-2026-98748

Received Received - Intake

Use-After-Free in Linux Kernel 8250 BCM7271 Serial Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv. brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory. Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ, so brcmuart_handle_irq() can no longer restart the timer, and the final hrtimer_cancel() drains any timer that was armed before or during the unregister. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98748

EUVD

EUVD-2026-103833

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	41a469482de257ea8db43cf74b6311bd055de030
Linux	Linux	41a469482de257ea8db43cf74b6311bd055de030
Linux	Linux	41a469482de257ea8db43cf74b6311bd055de030
Linux	Linux	41a469482de257ea8db43cf74b6311bd055de030
Linux	Linux	5.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's 8250_bcm7271 serial driver. The issue occurs when brcmuart_remove() cancels a timer after unregistering the serial port, allowing a race condition where an interrupt can re-arm the timer after the driver's private data (priv) has been freed by devm. This leads to the timer callback (brcmuart_hrtimer_func()) dereferencing freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's 8250_bcm7271 serial driver and requires kernel-level detection. Check if your system uses the affected driver by running: lsmod | grep 8250_bcm7271. If loaded, inspect kernel logs for use-after-free errors with: dmesg | grep -i "use-after-free" or journalctl -k | grep -i "use-after-free"

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges by exploiting the use-after-free condition. Systems using the affected serial driver with hardware flow control enabled may be vulnerable to denial-of-service or privilege escalation attacks.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's serial driver, which could lead to memory corruption or crashes. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it is a low-level system stability issue rather than a data exposure or access control flaw.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-98748. If you cannot update immediately, disable the 8250_bcm7271 driver by blacklisting it: echo "blacklist 8250_bcm7271" >> /etc/modprobe.d/blacklist.conf and reboot.

Hi! I’m here to help you understand CVE-2026-98748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70