CVE-2026-98748 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv.
brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.
Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ, so brcmuart_handle_irq() can no longer restart the timer, and the final hrtimer_cancel() drains any timer that was armed before or during the unregister.
This issue was found by an in-house static analysis tool.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified as a use-after-free condition within the Linux kernel's serial driver for Broadcom BCM7271 chips stems from an incorrect ordering of resource cleanup operations during device removal. Specifically, the function brcmuart_remove() was originally designed to cancel the high-resolution timer (hrtimer) before unregistering the serial port. This sequence creates a critical race condition window where hardware interrupts can still be processed by the kernel's interrupt handling subsystem even after the driver has initiated its teardown process. The core of the issue lies in the interaction between brcmuart_handle_irq() and the hrtimer mechanism used to handle receive-timeout quirks when hardware flow control is enabled. When an interrupt arrives during this narrow window, it may trigger the timer callback function brcmuart_hrtimer_func(), which directly dereferences a pointer named priv that points to private driver data structures.
Because the port was unregistered after the timer cancellation attempt but before the actual memory deallocation occurred via devm (device resource management), there exists a period where the interrupt handler can re-arm or keep alive the hrtimer despite the removal process having started. Once the device resources are freed, any subsequent execution of the timer callback results in accessing memory that has already been returned to the system allocator and potentially reused for other purposes. This constitutes a classic use-after-free vulnerability, which is categorized under CWE-416: Use After Free. The exploitation of this flaw could allow an attacker with local access or those capable of triggering specific serial port conditions to cause kernel crashes, leading to denial of service, or potentially achieve arbitrary code execution if the freed memory region can be controlled and populated with malicious data structures that are then interpreted by the timer callback logic.
The operational impact of this vulnerability is significant for systems relying on stable serial communication through BCM7271 hardware. A successful exploitation could lead to system instability, kernel panics, or security breaches depending on the context in which the driver operates and what memory contents reside at the freed address space. The issue was discovered using an in-house static analysis tool, highlighting the importance of automated code review processes in identifying subtle concurrency bugs that are difficult to reproduce through standard testing methods. Such tools can detect logical errors in resource management sequences that might otherwise remain hidden until triggered under specific timing conditions involving hardware interrupts and timer expirations.
The resolution involves correcting the order of operations within brcmuart_remove() by unregistering the serial port before attempting to cancel the hrtimer. This change ensures that serial8250_unregister_port() is called first, which effectively shuts down the port and frees its associated interrupt request lines. By removing the IRQ handler early in the cleanup sequence, subsequent hardware interrupts are no longer processed by brcmuart_handle_irq(), thereby preventing any possibility of re-arming or maintaining the hrtimer after the removal process has begun. The final call to hrtimer_cancel() then safely drains any timer that was armed prior to or during the unregister operation without risking access to freed memory, as there are no longer active interrupt handlers capable of restarting the timer logic. This fix aligns with best practices for driver development and mitigates risks associated with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization by ensuring that shared resources like timers and interrupts are properly disabled before their underlying data structures are released, thereby preventing race conditions during device teardown phases in the Linux kernel subsystem.