CVE-2026-98544
In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad. Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live. Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Affected versions
Linux kernel versions
2.6.38
and later are affected. Fixed in
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98544?
CVE-2026-98544 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.38 onward and has been patched in 6.12.112, 6.18.55, 7.2.9 and others. CVE-2026-98544 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98544?
Yes. CVE-2026-98544 has been patched. Fixed versions include 6.12.112, 6.18.55, 7.2.9 and others. If you are running Linux kernel 2.6.38 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98544 actively exploited?
No. CVE-2026-98544 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.