CVE-2026-98544: bna: prevent IOC timer rearm during teardown
In the Linux kernel, the following vulnerability has been resolved:
bna: prevent IOC timer rearm during teardown
bna: prevent IOC timer rearm during teardown
bnadpciremove() and the probe disableioceth path call timerdeletesync() for ioctimer, semtimer and hbtimer, but not for iocpftimer. bnadiocpftimeout() then takes bnad->bnalock after freenetdev() has freed the struct bnad.
Deleting iocpftimer last does not fix this. semtimer and iocpftimer rearm each other: bnadiocpfsemtimeout() can arm iocpftimer, and bnadiocpftimeout() arms semtimer from bfaiochwsemget() when the semaphore is busy. timerdeletesync() only waits out its own callback. bnadiocethdisable() can time out and leave that callback live.
Shut all four IOC timers down with timershutdownsync() on both paths, so a later modtimer() is ignored.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Shut all four IOC timers down with timer_shutdown_sync() during teardown; timer_delete_sync() is insufficient because it only waits for the current callback and does not prevent later mod_timer() rearming.
bna/bnad IOC timers IOC timer teardown API = timer_shutdown_sync()