CVE-2026-98544

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bna: prevent IOC timer rearm during teardown

bna: prevent IOC timer rearm during teardown

bnad_pci_remove() and the probe disable_ioceth path call

timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for

iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after

free_netdev() has freed the struct bnad.

Deleting iocpf_timer last does not fix this. sem_timer and

iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm

iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from

bfa_ioc_hw_sem_get() when the semaphore is busy.

timer_delete_sync() only waits out its own callback.

bnad_ioceth_disable() can time out and leave that callback live.

Shut all four IOC timers down with timer_shutdown_sync() on both

paths, so a later mod_timer() is ignored.

This issue was identified during our ongoing static-analysis research

while reviewing kernel code.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References