CVE-2026-98749

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: max3100: shut down timer before freeing port

max3100_shutdown() stops the polling timer but returns early during

system suspend. If the SPI device is unbound before resume, the serial

core does not call max3100_shutdown() again, so max3100_remove() frees

the port while the timer remains armed. max3100_timeout() may then

access the freed port and re-arm the timer.

Add final timer teardown to max3100_remove() and use

timer_shutdown_sync() to prevent a racing callback from re-arming it.

Also free the IRQ and destroy the workqueue there before freeing the

port. Keep timer_delete_sync() in max3100_shutdown() so that a

subsequent open() can re-arm the timer.

The workqueue is created before request_irq() and destroyed on both

request_irq() failure and normal shutdown. Its presence at remove thus

identifies the IRQ left registered when suspend bypasses shutdown.

Free the IRQ before destroying the workqueue, i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References