In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during… (CVE-2026-98544)

The vulnerability in the Linux kernel's bna driver relates to the improper management of IOC timers during device teardown. While some timers (ioc_timer, sem_timer, hb_timer) were deleted synchronously, the iocpf_timer was not, allowing callbacks to occur after the associated memory (struct bnad) was freed by free_netdev(). This could lead to use-after-free conditions. The sem_timer and iocpf_timer can rearm each other, complicating the issue. The resolution was to shut down all four IOC timers with timer_shutdown_sync() on both removal and probe disable paths, ensuring no timer callbacks occur after teardown.

The vulnerability could lead to use-after-free conditions in kernel memory, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions containing the vulnerable bna driver code.

A fix has been implemented in the Linux kernel to shut down all IOC timers synchronously during teardown, preventing timer callbacks after memory is freed. Users should update to the fixed kernel version containing this patch. No additional mitigation is required beyond applying the official fix.