CVE-2026-98749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.368Z", "datePublished": "2026-10-18T15:47:34.347Z", "dateUpdated": "2026-10-30T12:39:19.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:19.454Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: max3100: shut down timer before freeing port\n\nmax3100_shutdown() stops the polling timer but returns early during\nsystem suspend. If the SPI device is unbound before resume, the serial\ncore does not call max3100_shutdown() again, so max3100_remove() frees\nthe port while the timer remains armed. max3100_timeout() may then\naccess the freed port and re-arm the timer.\n\nAdd final timer teardown to max3100_remove() and use\ntimer_shutdown_sync() to prevent a racing callback from re-arming it.\nAlso free the IRQ and destroy the workqueue there before freeing the\nport. Keep timer_delete_sync() in max3100_shutdown() so that a\nsubsequent open() can re-arm the timer.\n\nThe workqueue is created before request_irq() and destroyed on both\nrequest_irq() failure and normal shutdown. Its presence at remove thus\nidentifies the IRQ left registered when suspend bypasses shutdown.\n\nFree the IRQ before destroying the workqueue, in both\nmax3100_shutdown() and max3100_remove(), and cancel the pending work\nin between. free_irq() waits for a running interrupt handler to\nfinish and no new handler can start afterwards, so a racing handler\ncannot queue work on a workqueue that is being destroyed; the\nforce_end_work check in max3100_dowork() only narrows that window, as\na handler delayed between the check and queue_work() could still run\nafter the teardown has cleared the workqueue pointer. Cancelling the\nwork also keeps destroy_workqueue() from waiting on a queued work item\nin case remove() ever runs while the freezable workqueue is still\nfrozen, e.g. device removal during the resume window, before\nworkqueues are thawed.\n\nThis issue was found by an in-house static analysis tool."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/max3100.c"], "versions": [{"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "d1187a7deac1e90182372a188dfe33ddd2b53cba", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "cbb3fcc7cd14396ccc1379c164d96a247331f2e6", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "fb8cefd66a6055a313c993fa9e8bed9be9b088f6", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "158a07da2da720f2f98b4bea129212c6805d8ee0", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "fb668620e3b163962dabe1a674725a07aa44ff4a", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "2c8614981d3e6e000427de0ab2426ab68274d850", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "247b8f680876313586aed4d267bfcceddc2b4901", "status": "affected", "versionType": "git"}, {"version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "lessThan": "db0949bbd06db0a75b4b1076f1e25194be7d956a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/max3100.c"], "versions": [{"version": "2.6.30", "status": "affected"}, {"version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d1187a7deac1e90182372a188dfe33ddd2b53cba"}, {"url": "https://git.kernel.org/stable/c/cbb3fcc7cd14396ccc1379c164d96a247331f2e6"}, {"url": "https://git.kernel.org/stable/c/fb8cefd66a6055a313c993fa9e8bed9be9b088f6"}, {"url": "https://git.kernel.org/stable/c/158a07da2da720f2f98b4bea129212c6805d8ee0"}, {"url": "https://git.kernel.org/stable/c/fb668620e3b163962dabe1a674725a07aa44ff4a"}, {"url": "https://git.kernel.org/stable/c/2c8614981d3e6e000427de0ab2426ab68274d850"}, {"url": "https://git.kernel.org/stable/c/247b8f680876313586aed4d267bfcceddc2b4901"}, {"url": "https://git.kernel.org/stable/c/db0949bbd06db0a75b4b1076f1e25194be7d956a"}], "title": "tty: serial: max3100: shut down timer before freeing port", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/serial/max3100.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d1187a7deac1e90182372a188dfe33ddd2b53cba", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "cbb3fcc7cd14396ccc1379c164d96a247331f2e6", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "fb8cefd66a6055a313c993fa9e8bed9be9b088f6", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "158a07da2da720f2f98b4bea129212c6805d8ee0", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "fb668620e3b163962dabe1a674725a07aa44ff4a", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "2c8614981d3e6e000427de0ab2426ab68274d850", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "247b8f680876313586aed4d267bfcceddc2b4901", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}, {"lessThan": "db0949bbd06db0a75b4b1076f1e25194be7d956a", "status": "affected", "version": "7831d56b0a3544cbb6f82f76c34ca95e24d5b676", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/serial/max3100.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: max3100: shut down timer before freeing port\n\nmax3100_shutdown() stops the polling timer but returns early during\nsystem suspend. If the SPI device is unbound before resume, the serial\ncore does not call max3100_shutdown() again, so max3100_remove() frees\nthe port while the timer remains armed. max3100_timeout() may then\naccess the freed port and re-arm the timer.\n\nAdd final timer teardown to max3100_remove() and use\ntimer_shutdown_sync() to prevent a racing callback from re-arming it.\nAlso free the IRQ and destroy the workqueue there before freeing the\nport. Keep timer_delete_sync() in max3100_shutdown() so that a\nsubsequent open() can re-arm the timer.\n\nThe workqueue is created before request_irq() and destroyed on both\nrequest_irq() failure and normal shutdown. Its presence at remove thus\nidentifies the IRQ left registered when suspend bypasses shutdown.\n\nFree the IRQ before destroying the workqueue, in both\nmax3100_shutdown() and max3100_remove(), and cancel the pending work\nin between. free_irq() waits for a running interrupt handler to\nfinish and no new handler can start afterwards, so a racing handler\ncannot queue work on a workqueue that is being destroyed; the\nforce_end_work check in max3100_dowork() only narrows that window, as\na handler delayed between the check and queue_work() could still run\nafter the teardown has cleared the workqueue pointer. Cancelling the\nwork also keeps destroy_workqueue() from waiting on a queued work item\nin case remove() ever runs while the freezable workqueue is still\nfrozen, e.g. device removal during the resume window, before\nworkqueues are thawed.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-98749", "lastModified": "2026-10-30T13:21:23.600", "metrics": {}, "published": "2026-10-18T16:17:28.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/158a07da2da720f2f98b4bea129212c6805d8ee0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/247b8f680876313586aed4d267bfcceddc2b4901"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c8614981d3e6e000427de0ab2426ab68274d850"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cbb3fcc7cd14396ccc1379c164d96a247331f2e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1187a7deac1e90182372a188dfe33ddd2b53cba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db0949bbd06db0a75b4b1076f1e25194be7d956a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb668620e3b163962dabe1a674725a07aa44ff4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb8cefd66a6055a313c993fa9e8bed9be9b088f6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in MAX3100 serial driver", "id": "2555173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555173"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntty: serial: max3100: shut down timer before freeing port\nmax3100_shutdown() stops the polling timer but returns early during\nsystem suspend. If the SPI device is unbound before resume, the serial\ncore does not call max3100_shutdown() again, so max3100_remove() frees\nthe port while the timer remains armed. max3100_timeout() may then\naccess the freed port and re-arm the timer.\nAdd final timer teardown to max3100_remove() and use\ntimer_shutdown_sync() to prevent a racing callback from re-arming it.\nAlso free the IRQ and destroy the workqueue there before freeing the\nport. Keep timer_delete_sync() in max3100_shutdown() so that a\nsubsequent open() can re-arm the timer.\nThe workqueue is created before request_irq() and destroyed on both\nrequest_irq() failure and normal shutdown. Its presence at remove thus\nidentifies the IRQ left registered when suspend bypasses shutdown.\nFree the IRQ before destroying the workqueue, in both\nmax3100_shutdown() and max3100_remove(), and cancel the pending work\nin between. free_irq() waits for a running interrupt handler to\nfinish and no new handler can start afterwards, so a racing handler\ncannot queue work on a workqueue that is being destroyed; the\nforce_end_work check in max3100_dowork() only narrows that window, as\na handler delayed between the check and queue_work() could still run\nafter the teardown has cleared the workqueue pointer. Cancelling the\nwork also keeps destroy_workqueue() from waiting on a queued work item\nin case remove() ever runs while the freezable workqueue is still\nfrozen, e.g. device removal during the resume window, before\nworkqueues are thawed.\nThis issue was found by an in-house static analysis tool.", "A flaw was found in the MAX3100 serial driver in the Linux kernel. This flaw allows a local privileged user to cause a Denial of Service (DoS) or memory corruption by unbinding the device during a system suspend cycle. In this scenario, the driver releases the device port memory while an active polling timer is still running. When the timer callback executes, it accesses the already-freed memory, triggering a use-after-free condition that can crash the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98749", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:47:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98749\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98749\nhttps://git.kernel.org/stable/c/247b8f680876313586aed4d267bfcceddc2b4901\nhttps://git.kernel.org/stable/c/2c8614981d3e6e000427de0ab2426ab68274d850\nhttps://git.kernel.org/stable/c/db0949bbd06db0a75b4b1076f1e25194be7d956a\nhttps://git.kernel.org/stable/c/fb668620e3b163962dabe1a674725a07aa44ff4a"], "statement": "A race in the MAX3100 serial driver can leave the polling timer armed when the SPI device is removed during the suspend window. max3100_remove can then free the port while max3100_timeout still holds a reference to it, allowing the callback to access freed memory and rearm the timer. The IRQ and workqueue teardown order also permits a racing interrupt handler to interact with workqueue state during removal. For the CVSS the PR:L value in the paranoid score represents environments where device teardown is delegated to a reduced capability root, container manager, or service account. A standard system normally requires administrative privileges and is better represented by PR:H. The issue is local and is not network reachable. Impact is at least denial of service through a kernel crash.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,fb668620e3b163962dabe1a674725a07aa44ff4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,2c8614981d3e6e000427de0ab2426ab68274d850)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,247b8f680876313586aed4d267bfcceddc2b4901)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,db0949bbd06db0a75b4b1076f1e25194be7d956a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.30"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.30)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:15:14.857570+00:00", "updated": "2026-10-20T22:00:16.078410+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}