CVE-2026-98544
Received Received - Intake

Race Condition in Linux Kernel bna Driver Leads to Use-After-Free

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad. Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live. Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98544
EUVD
EUVD-2026-103589

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 1d32f7696286eef9e5644eb57e79a36756274357
Linux Linux 1d32f7696286eef9e5644eb57e79a36756274357
Linux Linux 1d32f7696286eef9e5644eb57e79a36756274357
Linux Linux 1d32f7696286eef9e5644eb57e79a36756274357
Linux Linux 2.6.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of timers during device teardown. Specifically, the bna driver fails to properly shut down all timers (ioc_timer, sem_timer, hb_timer, iocpf_timer) when removing a device. This can lead to a use-after-free scenario where a timer callback attempts to access freed memory after the device is removed.

Detection Guidance

This vulnerability is specific to the Linux kernel's bna driver and requires kernel code analysis for detection. No standard commands can directly detect it. Review kernel logs for bna-related errors or crashes, particularly during driver unloading or timer operations.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It may lead to kernel memory corruption or unexpected behavior due to timer callbacks running on freed memory.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid unloading or reloading the bna driver until patched. Monitor kernel updates from your distribution for a fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart