CVE-2026-98749 Overview
CVE-2026-98749 is a use-after-free vulnerability in the Linux kernel max3100 SPI UART driver. The flaw lives in the tty: serial: max3100 subsystem, where max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core skips a second max3100_shutdown() call, and max3100_remove() frees the port while the timer remains armed. The pending max3100_timeout() callback then accesses freed memory and re-arms the timer against a stale port.
Critical Impact
An attacker able to trigger device unbind during the suspend/resume window can cause kernel memory corruption through a dangling timer callback accessing a freed serial port structure.
Affected Products
- Linux kernel builds including the max3100 SPI serial driver (drivers/tty/serial/max3100.c)
- Embedded and IoT systems that expose MAX3100 UART-over-SPI hardware
- Stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98749 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98749
Vulnerability Analysis
The max3100 driver uses a polling timer and a freezable workqueue to service the SPI-attached UART. During normal teardown, max3100_shutdown() cancels the timer, releases the IRQ, and tears down the workqueue. During system suspend, however, the function returns early to preserve state across the suspend cycle.
If userspace or the device model unbinds the SPI device before the system resumes, the serial core does not invoke max3100_shutdown() a second time. Control passes directly to max3100_remove(), which previously freed the port without stopping the still-armed timer. When max3100_timeout() fires, it dereferences the freed port and schedules work, producing a classic use-after-free [CWE-416] condition on kernel heap memory.
Root Cause
The root cause is incomplete resource teardown in the remove path when suspend bypasses the shutdown path. The timer, IRQ handler, and freezable workqueue outlive the port structure. A racing max3100_dowork() handler can queue work on a workqueue being destroyed, since the force_end_work check only narrows but does not close the race window.
Attack Vector
Exploitation requires local privileges capable of triggering SPI device unbind during the suspend/resume window, typically through sysfs bind/unbind controls or hotplug events. Successful exploitation produces kernel memory corruption that can lead to denial of service or potential privilege escalation if the freed slab is reclaimed with attacker-controlled data before the timer callback runs.
The upstream fix adds timer_shutdown_sync() to max3100_remove() to prevent a racing callback from re-arming the timer. It also frees the IRQ before destroying the workqueue, cancels pending work in between, and keeps timer_delete_sync() in max3100_shutdown() so a subsequent open() can re-arm the timer. See the Kernel Git Commit fb668620 for the authoritative patch.
Detection Methods for CVE-2026-98749
Indicators of Compromise
- Kernel oops or KASAN use-after-free reports referencing max3100_timeout, max3100_dowork, or max3100_remove
- Slab corruption warnings correlated with SPI device unbind events during or shortly after system resume
- Unexpected serial port reinitialization messages following suspend cycles on systems with MAX3100 hardware
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_DEBUG_OBJECTS_TIMERS on test and development builds to surface the timer-after-free pattern early
- Audit kernel ring buffer logs for max3100 driver messages adjacent to pm_suspend or spi_unregister_device traces
- Compare running kernel version and drivers/tty/serial/max3100.c content against the fixed commits listed in the NVD references
Monitoring Recommendations
- Collect dmesg and /var/log/kern.log from embedded fleets using MAX3100 UARTs and alert on max3100 combined with BUG, WARN, or KASAN strings
- Track sysfs unbind operations on SPI devices through auditd rules covering /sys/bus/spi/drivers/max3100/unbind
- Monitor suspend/resume cycle counts on affected hardware for correlation with crash telemetry
How to Mitigate CVE-2026-98749
Immediate Actions Required
- Apply vendor kernel updates that incorporate the upstream max3100 teardown fix on all affected systems
- Inventory embedded and IoT assets that enable the MAX3100 driver and prioritize those exposed to multi-user or untrusted local access
- Restrict access to SPI sysfs bind/unbind interfaces to root-only contexts and audit any orchestration that touches them during suspend/resume
Patch Information
The fix is distributed across multiple stable kernel branches. Apply the commit matching your kernel series: 158a07da, 247b8f68, 2c861498, db0949bb, or fb668620.
Workarounds
- Disable the MAX3100 driver in kernel config (CONFIG_SERIAL_MAX3100=n) and rebuild where the hardware is not required
- Blocklist the max3100 module on systems that do not use the hardware by adding blacklist max3100 to /etc/modprobe.d/
- Avoid unbinding SPI devices through sysfs during active suspend/resume transitions on unpatched kernels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
