All vulnerabilities
CVE-2026-98748

Linux: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0794ba5332754866b2f1c0cca668775be3ffcf0aAlso 189b9dc8c96ec9486482f27c1372b04a7152175eCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0794ba5332754866b2f1c0cca668775be3ffcf0aLinuxCVE List
  • 189b9dc8c96ec9486482f27c1372b04a7152175eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv.

brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.

Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ, so brcmuart_handle_irq() can no longer restart the timer, and the final hrtimer_cancel() drains any timer that was armed before or during the unregister.

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 12

  • Linuxaffected: 41a469482de257ea8db43cf74b6311bd055de030 before dd81650bec58ac70e5dfde2ec390acc1f0d1ed76CVE List
  • Linuxaffected: 41a469482de257ea8db43cf74b6311bd055de030 before f5ce06e648d775cc1ccf66f4f594bb8b559a7d8eCVE List
  • Linuxaffected: 41a469482de257ea8db43cf74b6311bd055de030 before e32440fa536af96bdbc61d933a7c3a920b965edcCVE List
  • Linuxaffected: 41a469482de257ea8db43cf74b6311bd055de030 before 0794ba5332754866b2f1c0cca668775be3ffcf0aCVE List
  • Linuxaffected: 41a469482de257ea8db43cf74b6311bd055de030 before 189b9dc8c96ec9486482f27c1372b04a7152175eCVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5