All vulnerabilities
CVE-2026-98544

Linux: bna: prevent IOC timer rearm during teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28e32ace754b57534ef0ca0fb99bcbea5b13ba2aAlso 4d97a141e85a034566c33c7ed854c8a3e8a268f1, 77b1718e39e5c9f6956fb60807326af20baf889dCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 28e32ace754b57534ef0ca0fb99bcbea5b13ba2aLinuxCVE List
  • 4d97a141e85a034566c33c7ed854c8a3e8a268f1LinuxCVE List
  • 77b1718e39e5c9f6956fb60807326af20baf889dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bna: prevent IOC timer rearm during teardown

bna: prevent IOC timer rearm during teardown

bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad.

Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live.

Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

Text from CVE List

Affected versions 12

  • Linuxaffected: 1d32f7696286eef9e5644eb57e79a36756274357 before f04cbdfac9b8284146995ab7ba0d054ad1d20ec6CVE List
  • Linuxaffected: 1d32f7696286eef9e5644eb57e79a36756274357 before 28e32ace754b57534ef0ca0fb99bcbea5b13ba2aCVE List
  • Linuxaffected: 1d32f7696286eef9e5644eb57e79a36756274357 before 4d97a141e85a034566c33c7ed854c8a3e8a268f1CVE List
  • Linuxaffected: 1d32f7696286eef9e5644eb57e79a36756274357 before e09d1c6729ee4a7812128902d9274ff565f958b8CVE List
  • Linuxaffected: 1d32f7696286eef9e5644eb57e79a36756274357 before 77b1718e39e5c9f6956fb60807326af20baf889dCVE List
  • Linuxaffected: 2.6.38CVE List
  • Linuxunaffected: all versions before 2.6.38CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5