{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98748", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:33.446Z", "dateUpdated": "2026-10-30T12:39:18.369Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:18.369Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_bcm7271: fix use-after-free in brcmuart_remove()\n\nbrcmuart_handle_irq() starts priv->hrt to work around a receive-timeout\nquirk of the 8250 core when hardware flow control is enabled; the timer\ncallback brcmuart_hrtimer_func() dereferences priv.\n\nbrcmuart_remove() cancels the hrtimer before it unregisters the port, so\na receive-timeout interrupt that arrives in between re-arms the timer.\nAfter devm frees priv, the callback runs on freed memory.\n\nUnregister the port before cancelling the hrtimer.\nserial8250_unregister_port() shuts the port down and frees its IRQ, so\nbrcmuart_handle_irq() can no longer restart the timer, and the final\nhrtimer_cancel() drains any timer that was armed before or during the\nunregister.\n\nThis issue was found by an in-house static analysis tool."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/8250/8250_bcm7271.c"], "versions": [{"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "134d239558f2ac2602fad2392ec3e6d8d76af7d8", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "dad9fb86829ee96bbc6315d7209ceb24820ef889", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "dd81650bec58ac70e5dfde2ec390acc1f0d1ed76", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "f5ce06e648d775cc1ccf66f4f594bb8b559a7d8e", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "e32440fa536af96bdbc61d933a7c3a920b965edc", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "0794ba5332754866b2f1c0cca668775be3ffcf0a", "status": "affected", "versionType": "git"}, {"version": "41a469482de257ea8db43cf74b6311bd055de030", "lessThan": "189b9dc8c96ec9486482f27c1372b04a7152175e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/serial/8250/8250_bcm7271.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/134d239558f2ac2602fad2392ec3e6d8d76af7d8"}, {"url": "https://git.kernel.org/stable/c/dad9fb86829ee96bbc6315d7209ceb24820ef889"}, {"url": "https://git.kernel.org/stable/c/dd81650bec58ac70e5dfde2ec390acc1f0d1ed76"}, {"url": "https://git.kernel.org/stable/c/f5ce06e648d775cc1ccf66f4f594bb8b559a7d8e"}, {"url": "https://git.kernel.org/stable/c/e32440fa536af96bdbc61d933a7c3a920b965edc"}, {"url": "https://git.kernel.org/stable/c/0794ba5332754866b2f1c0cca668775be3ffcf0a"}, {"url": "https://git.kernel.org/stable/c/189b9dc8c96ec9486482f27c1372b04a7152175e"}], "title": "serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/serial/8250/8250_bcm7271.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "134d239558f2ac2602fad2392ec3e6d8d76af7d8", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "dad9fb86829ee96bbc6315d7209ceb24820ef889", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "dd81650bec58ac70e5dfde2ec390acc1f0d1ed76", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "f5ce06e648d775cc1ccf66f4f594bb8b559a7d8e", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "e32440fa536af96bdbc61d933a7c3a920b965edc", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "0794ba5332754866b2f1c0cca668775be3ffcf0a", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}, {"lessThan": "189b9dc8c96ec9486482f27c1372b04a7152175e", "status": "affected", "version": "41a469482de257ea8db43cf74b6311bd055de030", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/serial/8250/8250_bcm7271.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_bcm7271: fix use-after-free in brcmuart_remove()\n\nbrcmuart_handle_irq() starts priv->hrt to work around a receive-timeout\nquirk of the 8250 core when hardware flow control is enabled; the timer\ncallback brcmuart_hrtimer_func() dereferences priv.\n\nbrcmuart_remove() cancels the hrtimer before it unregisters the port, so\na receive-timeout interrupt that arrives in between re-arms the timer.\nAfter devm frees priv, the callback runs on freed memory.\n\nUnregister the port before cancelling the hrtimer.\nserial8250_unregister_port() shuts the port down and frees its IRQ, so\nbrcmuart_handle_irq() can no longer restart the timer, and the final\nhrtimer_cancel() drains any timer that was armed before or during the\nunregister.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-98748", "lastModified": "2026-10-30T13:21:23.413", "metrics": {}, "published": "2026-10-18T16:17:28.557", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0794ba5332754866b2f1c0cca668775be3ffcf0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/134d239558f2ac2602fad2392ec3e6d8d76af7d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/189b9dc8c96ec9486482f27c1372b04a7152175e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dad9fb86829ee96bbc6315d7209ceb24820ef889"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd81650bec58ac70e5dfde2ec390acc1f0d1ed76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e32440fa536af96bdbc61d933a7c3a920b965edc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5ce06e648d775cc1ccf66f4f594bb8b559a7d8e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in Broadcom serial driver", "id": "2555145", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555145"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nserial: 8250_bcm7271: fix use-after-free in brcmuart_remove()\nbrcmuart_handle_irq() starts priv->hrt to work around a receive-timeout\nquirk of the 8250 core when hardware flow control is enabled; the timer\ncallback brcmuart_hrtimer_func() dereferences priv.\nbrcmuart_remove() cancels the hrtimer before it unregisters the port, so\na receive-timeout interrupt that arrives in between re-arms the timer.\nAfter devm frees priv, the callback runs on freed memory.\nUnregister the port before cancelling the hrtimer.\nserial8250_unregister_port() shuts the port down and frees its IRQ, so\nbrcmuart_handle_irq() can no longer restart the timer, and the final\nhrtimer_cancel() drains any timer that was armed before or during the\nunregister.\nThis issue was found by an in-house static analysis tool.", "A flaw was found in the Linux kernel's Broadcom serial driver. A local attacker could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. During device removal, an incoming interrupt can restart a timer after it has been cancelled, leading to a use-after-free condition where the system attempts to access memory that has already been deallocated."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98748", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:47:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98748\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98748\nhttps://git.kernel.org/stable/c/0794ba5332754866b2f1c0cca668775be3ffcf0a\nhttps://git.kernel.org/stable/c/189b9dc8c96ec9486482f27c1372b04a7152175e\nhttps://git.kernel.org/stable/c/e32440fa536af96bdbc61d933a7c3a920b965edc\nhttps://git.kernel.org/stable/c/f5ce06e648d775cc1ccf66f4f594bb8b559a7d8e"], "statement": "A race in brcmuart_remove can rearm the UART high resolution timer after it has been cancelled but before the serial port and its IRQ are unregistered. The timer callback can then run after devm has freed brcmuart_priv and dereference freed kernel memory, resulting in a use after free. For the CVSS the PR:H is selected because reliable triggering normally requires administrative control over device or driver removal while a receive timeout interrupt reaches the UART. AC:H applies because the interrupt and removal paths must overlap within a limited race window. The issue is not directly network reachable and normally requires a system with the affected Broadcom STB UART driver and hardware. Impact is at least a local denial of service through a kernel crash.", "threat_severity": "Moderate"}