CVE-2026-98748: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250bcm7271: fix use-after-free in brcmuartremove()

brcmuarthandleirq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc() dereferences priv.

brcmuartremove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.

Unregister the port before cancelling the hrtimer. serial8250unregisterport() shuts the port down and frees its IRQ, so brcmuarthandleirq() can no longer restart the timer, and the final hrtimercancel() drains any timer that was armed before or during the unregister.

This issue was found by an in-house static analysis tool.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
In brcmuart_remove(), unregister the port before cancelling the hrtimer so callbacks cannot dereference freed priv memory.

Event History

Oct 18, 2026

CVE Published

via MITRE·03:47 PM

Data Sourced

via MITRE·03:47 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this use-after-free?

Systems using the Linux kernel's 8250_bcm7271 serial driver are exposed when the driver is removed while its receive-timeout handling can still receive interrupts. The vulnerable path involves hardware flow control, which causes the driver to use a high-resolution timer for an 8250 receive-timeout quirk.

What timing is required to trigger the flaw?

A receive-timeout interrupt must arrive after brcmuart_remove() cancels the high-resolution timer but before it unregisters the serial port. That interrupt can re-arm the timer, and its callback can later dereference the driver private data after it has been freed.

What change fixes the race?

The fix unregisters the serial port before cancelling the high-resolution timer. Port unregistration shuts down the port and frees its IRQ, preventing the interrupt handler from re-arming the timer; the subsequent timer cancellation drains any timer already armed.

CVE-2026-98748: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this use-after-free?

What timing is required to trigger the flaw?

What change fixes the race?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this use-after-free?

What timing is required to trigger the flaw?

What change fixes the race?