In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()… (CVE-2026-98748)

The Linux kernel's serial driver for the 8250_bcm7271 chipset contained a use-after-free vulnerability in the brcmuart_remove() function. The brcmuart_handle_irq() function starts a high-resolution timer (hrt) to handle a receive-timeout quirk when hardware flow control is enabled. The timer callback brcmuart_hrtimer_func() dereferences a pointer to private data (priv). The vulnerability arises because brcmuart_remove() cancels the hrtimer after unregistering the port, allowing a receive-timeout interrupt to re-arm the timer after the private data has been freed by devm. This results in the timer callback running on freed memory. The fix involves unregistering the port before cancelling the hrtimer, ensuring the port is shut down and its IRQ freed before the timer is cancelled, preventing the callback from accessing freed memory. The issue was discovered using an in-house static analysis tool.

This vulnerability could lead to use-after-free conditions in kernel memory, potentially causing system instability or crashes. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected serial driver and hardware.

A fix is available that changes the order of operations in the brcmuart_remove() function to unregister the port before cancelling the high-resolution timer. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel version is the recommended remediation.