CVE-2026-98749
Received Received - Intake

Use-After-Free in Linux Kernel max3100 Serial Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100_shutdown() again, so max3100_remove() frees the port while the timer remains armed. max3100_timeout() may then access the freed port and re-arm the timer. Add final timer teardown to max3100_remove() and use timer_shutdown_sync() to prevent a racing callback from re-arming it. Also free the IRQ and destroy the workqueue there before freeing the port. Keep timer_delete_sync() in max3100_shutdown() so that a subsequent open() can re-arm the timer. The workqueue is created before request_irq() and destroyed on both request_irq() failure and normal shutdown. Its presence at remove thus identifies the IRQ left registered when suspend bypasses shutdown. Free the IRQ before destroying the workqueue, in both max3100_shutdown() and max3100_remove(), and cancel the pending work in between. free_irq() waits for a running interrupt handler to finish and no new handler can start afterwards, so a racing handler cannot queue work on a workqueue that is being destroyed; the force_end_work check in max3100_dowork() only narrows that window, as a handler delayed between the check and queue_work() could still run after the teardown has cleared the workqueue pointer. Cancelling the work also keeps destroy_workqueue() from waiting on a queued work item in case remove() ever runs while the freezable workqueue is still frozen, e.g. device removal during the resume window, before workqueues are thawed. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98749
EUVD
EUVD-2026-103834

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 7831d56b0a3544cbb6f82f76c34ca95e24d5b676
Linux Linux 7831d56b0a3544cbb6f82f76c34ca95e24d5b676
Linux Linux 7831d56b0a3544cbb6f82f76c34ca95e24d5b676
Linux Linux 7831d56b0a3544cbb6f82f76c34ca95e24d5b676
Linux Linux 2.6.30

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's max3100 serial driver. It occurs when the SPI device is unbound before system resume, causing the serial port to be freed while a timer is still active. The timer callback may then access the freed memory, potentially leading to crashes or privilege escalation.

Detection Guidance

This vulnerability is specific to the Linux kernel's max3100 serial driver and does not have a direct network detection method. Detection involves checking if the affected kernel code is present and if the timer teardown issue exists. Inspect the kernel version and the max3100 driver code for the described flaw.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges. It may lead to system instability, denial of service, or unauthorized access depending on the attacker's capabilities and system configuration.

Mitigation Strategies

Apply the kernel patch that resolves the issue by adding final timer teardown to max3100_remove() and using timer_shutdown_sync(). Update to a patched kernel version if available. Monitor for SPI device unbinding issues during suspend/resume cycles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98749. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart