CVE-2026-98544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98544", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.356Z", "datePublished": "2026-10-18T15:18:12.964Z", "dateUpdated": "2026-10-30T12:38:23.865Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:23.865Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\n\nDeleting iocpf_timer last does not fix this. sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\n\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/brocade/bna/bnad.c"], "versions": [{"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "8160cd1ec527caedd36c36f948234e834cd086e6", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "3614582375fc4407e09ff42ff178a045e2fe6e8f", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "f04cbdfac9b8284146995ab7ba0d054ad1d20ec6", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "28e32ace754b57534ef0ca0fb99bcbea5b13ba2a", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "4d97a141e85a034566c33c7ed854c8a3e8a268f1", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "e09d1c6729ee4a7812128902d9274ff565f958b8", "status": "affected", "versionType": "git"}, {"version": "1d32f7696286eef9e5644eb57e79a36756274357", "lessThan": "77b1718e39e5c9f6956fb60807326af20baf889d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/brocade/bna/bnad.c"], "versions": [{"version": "2.6.38", "status": "affected"}, {"version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8160cd1ec527caedd36c36f948234e834cd086e6"}, {"url": "https://git.kernel.org/stable/c/3614582375fc4407e09ff42ff178a045e2fe6e8f"}, {"url": "https://git.kernel.org/stable/c/f04cbdfac9b8284146995ab7ba0d054ad1d20ec6"}, {"url": "https://git.kernel.org/stable/c/28e32ace754b57534ef0ca0fb99bcbea5b13ba2a"}, {"url": "https://git.kernel.org/stable/c/4d97a141e85a034566c33c7ed854c8a3e8a268f1"}, {"url": "https://git.kernel.org/stable/c/e09d1c6729ee4a7812128902d9274ff565f958b8"}, {"url": "https://git.kernel.org/stable/c/77b1718e39e5c9f6956fb60807326af20baf889d"}], "title": "bna: prevent IOC timer rearm during teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/brocade/bna/bnad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8160cd1ec527caedd36c36f948234e834cd086e6", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "3614582375fc4407e09ff42ff178a045e2fe6e8f", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "f04cbdfac9b8284146995ab7ba0d054ad1d20ec6", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "28e32ace754b57534ef0ca0fb99bcbea5b13ba2a", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "4d97a141e85a034566c33c7ed854c8a3e8a268f1", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "e09d1c6729ee4a7812128902d9274ff565f958b8", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}, {"lessThan": "77b1718e39e5c9f6956fb60807326af20baf889d", "status": "affected", "version": "1d32f7696286eef9e5644eb57e79a36756274357", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/brocade/bna/bnad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"lessThan": "2.6.38", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\n\nDeleting iocpf_timer last does not fix this. sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\n\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."}], "id": "CVE-2026-98544", "lastModified": "2026-10-30T13:21:15.817", "metrics": {}, "published": "2026-10-18T16:17:06.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/28e32ace754b57534ef0ca0fb99bcbea5b13ba2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3614582375fc4407e09ff42ff178a045e2fe6e8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d97a141e85a034566c33c7ed854c8a3e8a268f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77b1718e39e5c9f6956fb60807326af20baf889d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8160cd1ec527caedd36c36f948234e834cd086e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e09d1c6729ee4a7812128902d9274ff565f958b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f04cbdfac9b8284146995ab7ba0d054ad1d20ec6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bna: prevent IOC timer rearm during teardown", "id": "2554964", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554964"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbna: prevent IOC timer rearm during teardown\nbna: prevent IOC timer rearm during teardown\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\nDeleting iocpf_timer last does not fix this. sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code.", "A flaw was found in the Linux kernel's Brocade 10Gb Ethernet (bna) driver. During device removal or shutdown, internal timers can rearm each other and continue executing after associated driver data structures have been released. A local user with administrative privileges could exploit this race condition during device teardown, triggering a use-after-free flaw that causes a system crash and Denial of Service (DoS)."], "name": "CVE-2026-98544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98544\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98544.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d32f7696286eef9e5644eb57e79a36756274357,28e32ace754b57534ef0ca0fb99bcbea5b13ba2a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d32f7696286eef9e5644eb57e79a36756274357,4d97a141e85a034566c33c7ed854c8a3e8a268f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d32f7696286eef9e5644eb57e79a36756274357,e09d1c6729ee4a7812128902d9274ff565f958b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d32f7696286eef9e5644eb57e79a36756274357,77b1718e39e5c9f6956fb60807326af20baf889d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.38"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.38)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:30:16.959013+00:00", "updated": "2026-10-22T22:30:13.440497+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-825"]}