In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown()… (CVE-2026-98749)

The Linux kernel max3100 serial driver had a vulnerability where max3100_shutdown() stopped the polling timer but returned early during system suspend. If the SPI device was unbound before resume, max3100_shutdown() was not called again, leading max3100_remove() to free the port while the timer remained armed. This could cause max3100_timeout() to access freed memory and re-arm the timer, resulting in a use-after-free condition. The fix added final timer teardown in max3100_remove(), used timer_shutdown_sync() to prevent racing callbacks, freed the IRQ, destroyed the workqueue, and canceled pending work to avoid race conditions and ensure safe cleanup.

This vulnerability could lead to use-after-free conditions in kernel space, potentially causing system instability or crashes. However, no known exploits in the wild have been reported. The issue affects the max3100 serial driver in the Linux kernel and could impact systems using this driver during suspend/resume cycles with device unbinding.

A fix has been implemented in the Linux kernel to properly shut down the timer and clean up resources in the max3100 serial driver. Users should update to a kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.