CVE-2026-98544
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
bna: prevent IOC timer rearm during teardown
bna: prevent IOC timer rearm during teardown
bnad_pci_remove() y la ruta disable_ioceth de la sonda llaman a timer_delete_sync() para ioc_timer, sem_timer y hb_timer, pero no para iocpf_timer. Entonces bnad_iocpf_timeout() adquiere bnad->bna_lock después de que free_netdev() haya liberado la estructura bnad.
Eliminar iocpf_timer en último lugar no soluciona el problema. sem_timer e iocpf_timer se vuelven a armar mutuamente: bnad_iocpf_sem_timeout() puede armar iocpf_timer, y bnad_iocpf_timeout() arma sem_timer desde bfa_ioc_hw_sem_get() cuando el semáforo está ocupado. timer_delete_sync() solo espera a que termine su propio callback. bnad_ioceth_disable() puede agotar el tiempo de espera y dejar ese callback activo.
Leer descripción completaMostrar menos
Se apagan los cuatro temporizadores de IOC con timer_shutdown_sync() en ambas rutas, de modo que una llamada posterior a mod_timer() se ignore.
Este problema se identificó durante nuestra investigación de análisis estático en curso al revisar código del kernel.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.20 %
- Percentil entre todas las CVEs puntuadas
- 9
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98544",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
"lessThan": "28e32ace754b57534ef0ca0fb99bcbea5b13ba2a",
"versionType": "git"
},
{
"status": "affected",
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
"lessThan": "4d97a141e85a034566c33c7ed854c8a3e8a268f1",
"versionType": "git"
},
{
"status": "affected",
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
"lessThan": "e09d1c6729ee4a7812128902d9274ff565f958b8",
"versionType": "git"
},
{
"status": "affected",
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
"lessThan": "77b1718e39e5c9f6956fb60807326af20baf889d",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/brocade/bna/bnad.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.38",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/brocade/bna/bnad.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:06.300",
"references": [
{
"url": "https://git.kernel.org/stable/c/28e32ace754b57534ef0ca0fb99bcbea5b13ba2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d97a141e85a034566c33c7ed854c8a3e8a268f1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/77b1718e39e5c9f6956fb60807326af20baf889d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e09d1c6729ee4a7812128902d9274ff565f958b8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\n\nDeleting iocpf_timer last does not fix this. sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\n\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."
}
],
"lastModified": "2026-10-19T10:19:10.343",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}