Cloudanix VulnDB

CVE-2026-98544

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in a network driver could let attackers crash servers or gain extra privileges when the driver is being removed from the system.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the bna Linux kernel driver where IOC-related timers (iocpf_timer, sem_timer) can fire after free_netdev() has released the struct bnad, because only timer_delete_sync() was used instead of timer_shutdown_sync() on all four timers, allowing callbacks to acquire bna_lock on freed memory.

Why it matters to the business

Systems using the affected Brocade/QLogic network adapter driver may experience kernel crashes, memory corruption, or potential local privilege escalation during driver unload or PCI device removal, leading to downtime and possible security compromise on servers or appliances with these adapters.

How an attack unfolds

An attacker with local access triggers driver teardown (e.g., module unload, PCI hot-remove, or interface disable) so that bnad_ioceth_disable() times out while leaving iocpf_timer or sem_timer callbacks scheduled; the callback then runs after the containing structure is freed and attempts to dereference it.

How to fix it

Apply the upstream kernel patch that replaces timer_delete_sync() calls with timer_shutdown_sync() for ioc_timer, sem_timer, hb_timer and iocpf_timer in both bnad_pci_remove() and bnad_ioceth_disable() paths; rebuild and reboot onto the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains the commit that uses timer_shutdown_sync() on all four IOC timers; inspect /proc/kallsyms or source for bnad_iocpf_timeout and verify no mod_timer calls remain possible after shutdown.

Typical attack path

  1. Obtain local access or ability to trigger driver removal
  2. Initiate PCI device removal or module unload path
  3. Force bnad_ioceth_disable() to time out leaving timer armed
  4. Timer callback executes post-free_netdev() and accesses freed bnad
  5. Resulting UAF causes crash or controlled memory corruption

How to detect it

Search kernel logs and crash dumps for oops/panic strings containing bna, bnad, iocpf_timer or bna_lock after device removal events; correlate with audit logs showing module unload or PCI remove operations.

What your security team should do

  • Prioritize kernel upgrade on any system exposing the bna driver
  • Audit for presence of Brocade/QLogic adapters and schedule maintenance windows
  • Enable kernel hardening features such as CONFIG_SLAB_FREELIST_RANDOM and page poisoning until patched
  • Monitor for oops or panic logs referencing bna or bnad during device removal

The record

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad. Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live. Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

Affected packages

Ecosystem Package Introduced Fixed