CVE-2026-98544 bna: prevent IOC timer rearm during teardown
A use-after-free vulnerability in the Linux kernel bna driver allows local attackers to cause denial of service or execute code during device teardown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98544?
CVE-2026-98544 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bna: prevent IOC timer rearm during teardown
bna: prevent IOC timer rearm during teardown
bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad.
Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live.
Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Which versions are affected by CVE-2026-98544?
How do I fix CVE-2026-98544?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98544 being exploited?
There is no known exploitation of CVE-2026-98544 in the wild and no public exploit code.
Sources
Also known as AZL-108945, BELL-CVE-2026-98544, DEBIAN-CVE-2026-98544, GHSA-crgf-pp48-gvh7, UBUNTU-CVE-2026-98544.