Live › vulnerability › CVE-2026-98748
Go to dashboardIn the Linux kernel's BCM7271 8250 serial driver, a receive-timeout interrupt during device removal can re-arm a timer after its private data has been freed. The timer callback then runs on freed memory, which can crash the kernel or be abused for memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the bcm7271 8250 serial driver, typically Broadcom STB set-top and embedded boards that use this UART with hardware flow control enabled. The bug only shows up when the port is removed while receive-timeout interrupts are arriving, so most servers and desktops are unaffected. unknown beyond this.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv.
brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory.
Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ, so brcmuart_handle_irq() can no longer restart the timer, and the final hrtimer_cancel() drains any timer that was armed before or during the unregister.
This issue was found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-98748")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.