In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnad_pci_remove() and the probe disable_ioceth path call timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after free_netdev() has freed the struct bnad. Deleting iocpf_timer last does not fix this. sem_timer and iocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm iocpf_timer, and bnad_iocpf_timeout() arms sem_timer from bfa_ioc_hw_sem_get() when the semaphore is busy. timer_delete_sync() only waits out its own callback. bnad_ioceth_disable() can time out and leave that callback live. Shut all four IOC timers down with timer_shutdown_sync() on both paths, so a later mod_timer() is ignored. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

A flaw was found in the Linux kernel's Brocade 10Gb Ethernet (bna) driver. During device removal or shutdown, internal timers can rearm each other and continue executing after associated driver data structures have been released. A local user with administrative privileges could exploit this race condition during device teardown, triggering a use-after-free flaw that causes a system crash and Denial of Service (DoS).

This vulnerability is rated as Moderate because exploitation requires local administrative privileges to trigger driver teardown on systems with specific Brocade 10Gb Ethernet hardware, limiting the impact to a denial of service. Unprivileged or remote attackers cannot trigger this race condition, and the flaw only manifests when unloading the driver or removing the device. Enterprise environments not utilizing Brocade network adapters are not exposed, and newer Red Hat Enterprise Linux releases do not include the vulnerable driver code. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98544 https://nvd.nist.gov/vuln/detail/CVE-2026-98544 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98544.mbox