CVE-2026-98748

serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv.

brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.

Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ, so brcmuart_handle_irq() can no longer restart the timer, and the final hrtimer_cancel() drains any timer that was armed before or during the unregister.

This issue was found by an in-house static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	41a469482de257ea8db43cf74b6311bd055de030 to before 134d239558f2ac2602fad2392ec3e6d8d76af7d8Affected 41a469482de257ea8db43cf74b6311bd055de030 to before dad9fb86829ee96bbc6315d7209ceb24820ef889Affected 41a469482de257ea8db43cf74b6311bd055de030 to before dd81650bec58ac70e5dfde2ec390acc1f0d1ed76Affected 41a469482de257ea8db43cf74b6311bd055de030 to before f5ce06e648d775cc1ccf66f4f594bb8b559a7d8eAffected 41a469482de257ea8db43cf74b6311bd055de030 to before e32440fa536af96bdbc61d933a7c3a920b965edcAffected 41a469482de257ea8db43cf74b6311bd055de030 to before 0794ba5332754866b2f1c0cca668775be3ffcf0aAffected 41a469482de257ea8db43cf74b6311bd055de030 to before 189b9dc8c96ec9486482f27c1372b04a7152175eAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

41a469482de257ea8db43cf74b6311bd055de030 to before 134d239558f2ac2602fad2392ec3e6d8d76af7d8Affected
41a469482de257ea8db43cf74b6311bd055de030 to before dad9fb86829ee96bbc6315d7209ceb24820ef889Affected
41a469482de257ea8db43cf74b6311bd055de030 to before dd81650bec58ac70e5dfde2ec390acc1f0d1ed76Affected
41a469482de257ea8db43cf74b6311bd055de030 to before f5ce06e648d775cc1ccf66f4f594bb8b559a7d8eAffected
41a469482de257ea8db43cf74b6311bd055de030 to before e32440fa536af96bdbc61d933a7c3a920b965edcAffected
41a469482de257ea8db43cf74b6311bd055de030 to before 0794ba5332754866b2f1c0cca668775be3ffcf0aAffected
41a469482de257ea8db43cf74b6311bd055de030 to before 189b9dc8c96ec9486482f27c1372b04a7152175eAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.