CVE-2026-98544: Linux Kernel Race Condition Vulnerability

CVE-2026-98544 Overview

CVE-2026-98544 is a use-after-free vulnerability in the Linux kernel's bna (Brocade Network Adapter) driver. The flaw occurs during device teardown when the iocpf_timer is not properly synchronized with other IOC (I/O Controller) timers. The bnad_iocpf_timeout() callback can acquire bnad->bna_lock after free_netdev() has already freed the struct bnad, resulting in access to freed memory.

Critical Impact
A race during driver teardown allows IOC timer callbacks to execute against freed struct bnad memory, enabling kernel memory corruption on systems using Brocade network adapters.

Affected Products

Linux kernel bna network driver (Brocade Network Adapter)
Multiple stable kernel branches referenced in upstream fix commits
Systems deploying Brocade/QLogic BNA-based network interface cards

Discovery Timeline

2026-10-18 - CVE CVE-2026-98544 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98544

Vulnerability Analysis

The bna driver manages four IOC-related timers: ioc_timer, sem_timer, hb_timer, and iocpf_timer. During teardown, bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for three of these timers but omit iocpf_timer. This oversight permits the iocpf_timer callback to run after the parent struct bnad has been released by free_netdev().

The callback bnad_iocpf_timeout() then takes bnad->bna_lock on freed memory. Any read, write, or lock operation against the dangling allocation can corrupt kernel state or trigger a crash. Reordering timer deletions alone does not resolve the issue because sem_timer and iocpf_timer rearm each other at runtime.

Root Cause

The root cause is a mutual-rearm pattern between kernel timers combined with incomplete teardown. bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() can arm sem_timer through bfa_ioc_hw_sem_get() when the hardware semaphore is busy. Because timer_delete_sync() only waits for its own callback to finish, a sibling callback can re-add the deleted timer immediately afterward. The bnad_ioceth_disable() path can additionally time out and leave callbacks live during resource release [CWE-416].

Attack Vector

Triggering this condition requires driver teardown events on systems with the bna driver loaded. Local actors who can induce device removal, module unload, or probe failures on affected hardware can race the timer callbacks against free_netdev(). Successful exploitation leads to use-after-free on kernel heap memory, with potential for denial of service or escalation depending on the surrounding allocator state. The upstream fix replaces all four timer_delete_sync() calls with timer_shutdown_sync() on both teardown paths, ensuring any later mod_timer() call is ignored.

Detection Methods for CVE-2026-98544

Indicators of Compromise

Kernel oops or panic traces referencing bnad_iocpf_timeout, bfa_ioc_hw_sem_get, or bnad_iocpf_sem_timeout after NIC removal or driver unload.
KASAN use-after-free reports pointing to struct bnad allocations freed by free_netdev().
Unexpected network interface disappearance followed by soft lockup messages on hosts using Brocade bna adapters.

Detection Strategies

Enable KASAN or SLUB debugging in test kernels to surface the use-after-free during bna driver teardown.
Monitor dmesg for timer-related stack traces originating in drivers/net/ethernet/brocade/bna/.
Audit kernel versions deployed on hosts with Brocade NICs and correlate against the upstream fix commits.

Monitoring Recommendations

Forward kernel ring buffer logs to a central SIEM and alert on crash signatures that include bna or iocpf symbols.
Track module load and unload events for the bna driver across the fleet to identify systems exposed to teardown races.
Correlate NIC hotplug or PCI remove events with subsequent kernel instability indicators.

How to Mitigate CVE-2026-98544

Immediate Actions Required

Inventory Linux hosts that load the bna kernel module and prioritize them for patching.
Apply the stable kernel update containing the upstream fix that replaces timer_delete_sync() with timer_shutdown_sync() for all four IOC timers.
Avoid repeated bna module unload or PCI device removal operations on unpatched hosts.

Patch Information

The fix shuts down ioc_timer, sem_timer, hb_timer, and iocpf_timer using timer_shutdown_sync() on both the bnad_pci_remove() and probe disable_ioceth paths. Patch commits are available in the upstream stable tree: Kernel Commit 28e32ac, Kernel Commit 4d97a14, Kernel Commit 77b1718, Kernel Commit e09d1c6, and Kernel Commit f04cbdfa.

Workarounds

Blocklist the bna module on hosts that do not require Brocade NIC functionality until the kernel is patched.
Restrict administrative access that could trigger module unload or PCI hot-remove operations on affected systems.
Schedule teardown and maintenance operations only during planned maintenance windows to limit race exposure.

bash

# Blocklist the bna driver until the kernel is patched
echo 'blacklist bna' | sudo tee /etc/modprobe.d/blacklist-bna.conf
sudo update-initramfs -u