CVE-2026-98748: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250bcm7271: fix use-after-free in brcmuartremove()
brcmuarthandleirq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc() dereferences priv.
brcmuartremove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.
Unregister the port before cancelling the hrtimer. serial8250unregisterport() shuts the port down and frees its IRQ, so brcmuarthandleirq() can no longer restart the timer, and the final hrtimercancel() drains any timer that was armed before or during the unregister.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In brcmuart_remove(), unregister the port before cancelling the hrtimer, then perform a final hrtimer_cancel() after serial8250_unregister_port() so brcmuart_handle_irq() cannot re-arm the timer and any timer armed during unregister is drained.
Event History
Frequently Asked Questions
Which systems are exposed to this use-after-free?
Systems using the Linux kernel's 8250_bcm7271 serial driver are exposed when the driver is removed while its receive-timeout handling can still receive interrupts. The vulnerable path involves hardware flow control, which causes the driver to use a high-resolution timer for an 8250 receive-timeout quirk.
What timing is required to trigger the flaw?
A receive-timeout interrupt must arrive after brcmuart_remove() cancels the high-resolution timer but before it unregisters the serial port. That interrupt can re-arm the timer, and its callback can later dereference the driver private data after it has been freed.
What change fixes the race?
The fix unregisters the serial port before cancelling the high-resolution timer. Port unregistration shuts down the port and frees its IRQ, preventing the interrupt handler from re-arming the timer; the subsequent timer cancellation drains any timer already armed.