{"cve":"CVE-2026-98544","nvd":{"published":"2026-10-18T16:17:06.300","modified":"2026-10-21T13:21:32.617","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer.  bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\n\nDeleting iocpf_timer last does not fix this.  sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\n\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/28e32ace754b57534ef0ca0fb99bcbea5b13ba2a","https://git.kernel.org/stable/c/4d97a141e85a034566c33c7ed854c8a3e8a268f1","https://git.kernel.org/stable/c/77b1718e39e5c9f6956fb60807326af20baf889d","https://git.kernel.org/stable/c/e09d1c6729ee4a7812128902d9274ff565f958b8","https://git.kernel.org/stable/c/f04cbdfac9b8284146995ab7ba0d054ad1d20ec6"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-98544","score":0.002,"percentile":0.09758,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}