CVE-2026-98749 - Vulnerability Details

- tty: serial: max3100: shut down timer before freeing port

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: max3100: shut down timer before freeing port

max3100_shutdown() stops the polling timer but returns early during
system suspend. If the SPI device is unbound before resume, the serial
core does not call max3100_shutdown() again, so max3100_remove() frees
the port while the timer remains armed. max3100_timeout() may then
access the freed port and re-arm the timer.

Add final timer teardown to max3100_remove() and use
timer_shutdown_sync() to prevent a racing callback from re-arming it.
Also free the IRQ and destroy the workqueue there before freeing the
port. Keep timer_delete_sync() in max3100_shutdown() so that a
subsequent open() can re-arm the timer.

The workqueue is created before request_irq() and destroyed on both
request_irq() failure and normal shutdown. Its presence at remove thus
identifies the IRQ left registered when suspend bypasses shutdown.

Free the IRQ before destroying the workqueue, in both
max3100_shutdown() and max3100_remove(), and cancel the pending work
in between. free_irq() waits for a running interrupt handler to
finish and no new handler can start afterwards, so a racing handler
cannot queue work on a workqueue that is being destroyed; the
force_end_work check in max3100_dowork() only narrows that window, as
a handler delayed between the check and queue_work() could still run
after the teardown has cleared the workqueue pointer. Cancelling the
work also keeps destroy_workqueue() from waiting on a queued work item
in case remove() ever runs while the freezable workqueue is still
frozen, e.g. device removal during the resume window, before
workqueues are thawed.

This issue was found by an in-house static analysis tool.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw lies in the Linux kernel’s max3100 serial driver. When the system suspends, the driver’s shutdown routine stops the polling timer but leaves it armed. If the SPI device is unbound before resume, the serial core does not call shutdown again, so during removal the driver frees the port while the timer remains active. When the timer callback fires afterward, it can access the freed port data and re‑arm the timer, creating a use‑after‑free condition. This can corrupt kernel memory or trigger a crash at the kernel level.

Affected Systems

All Linux kernel releases that ship with the default max3100 serial driver before the patch. The issue affects any system where the max3100 SPI device is present and the kernel has not yet been updated to a version that includes the final timer teardown and proper IRQ/workqueue handling.

Risk and Exploitability

The CVSS score of 4.7 indicates medium severity, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Because it requires a specific hardware device and a precise suspend–resume sequence, the risk is moderate: if successfully triggered, it could lead to kernel memory corruption or a crash, but there is no evidence of arbitrary code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< d1187a7deac1e90182372a188dfe33ddd2b53cba
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< cbb3fcc7cd14396ccc1379c164d96a247331f2e6
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< fb8cefd66a6055a313c993fa9e8bed9be9b088f6
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< 158a07da2da720f2f98b4bea129212c6805d8ee0
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< fb668620e3b163962dabe1a674725a07aa44ff4a
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< 2c8614981d3e6e000427de0ab2426ab68274d850
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< 247b8f680876313586aed4d267bfcceddc2b4901
`7831d56b0a3544cbb6f82f76c34ca95e24d5b676`	affected	< db0949bbd06db0a75b4b1076f1e25194be7d956a

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,fb668620e3b163962dabe1a674725a07aa44ff4a)`	affected	code_commit	—
`[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,2c8614981d3e6e000427de0ab2426ab68274d850)`	affected	code_commit	—
`[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,247b8f680876313586aed4d267bfcceddc2b4901)`	affected	code_commit	—
`[7831d56b0a3544cbb6f82f76c34ca95e24d5b676,db0949bbd06db0a75b4b1076f1e25194be7d956a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the updated Linux kernel that includes the max3100 timer and IRQ/workqueue fix
Restart the affected systems to load the patched kernel and fully free IRQs and workqueues
If the max3100 device is not required, disable or unload the driver or physically disconnect the hardware

Generated by OpenCVE AI on October 20, 2026 at 21:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/158a07da2da720f2f98b4bea129212c6805d8ee0
https://git.kernel.org/stable/c/247b8f680876313586aed4d267bfcceddc2b4901
https://git.kernel.org/stable/c/2c8614981d3e6e000427de0ab2426ab68274d850
https://git.kernel.org/stable/c/cbb3fcc7cd14396ccc1379c164d96a247331f2e6
https://git.kernel.org/stable/c/d1187a7deac1e90182372a188dfe33ddd2b53cba
https://git.kernel.org/stable/c/db0949bbd06db0a75b4b1076f1e25194be7d956a
https://git.kernel.org/stable/c/fb668620e3b163962dabe1a674725a07aa44ff4a
https://git.kernel.org/stable/c/fb8cefd66a6055a313c993fa9e8bed9be9b088f6
https://nvd.nist.gov/vuln/detail/CVE-2026-98749
https://www.cve.org/CVERecord?id=CVE-2026-98749

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/cbb3fcc7cd14396ccc1379c164d96a247331f2e6 https://git.kernel.org/stable/c/d1187a7deac1e90182372a188dfe33ddd2b53cba https://git.kernel.org/stable/c/fb8cefd66a6055a313c993fa9e8bed9be9b088f6

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/158a07da2da720f2f98b4bea129212c6805d8ee0

Tue, 20 Oct 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-367

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-98749 https://www.cve.org/CVERecord?id=CVE-2026-98749
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367 CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100_shutdown() again, so max3100_remove() frees the port while the timer remains armed. max3100_timeout() may then access the freed port and re-arm the timer. Add final timer teardown to max3100_remove() and use timer_shutdown_sync() to prevent a racing callback from re-arming it. Also free the IRQ and destroy the workqueue there before freeing the port. Keep timer_delete_sync() in max3100_shutdown() so that a subsequent open() can re-arm the timer. The workqueue is created before request_irq() and destroyed on both request_irq() failure and normal shutdown. Its presence at remove thus identifies the IRQ left registered when suspend bypasses shutdown. Free the IRQ before destroying the workqueue, in both max3100_shutdown() and max3100_remove(), and cancel the pending work in between. free_irq() waits for a running interrupt handler to finish and no new handler can start afterwards, so a racing handler cannot queue work on a workqueue that is being destroyed; the force_end_work check in max3100_dowork() only narrows that window, as a handler delayed between the check and queue_work() could still run after the teardown has cleared the workqueue pointer. Cancelling the work also keeps destroy_workqueue() from waiting on a queued work item in case remove() ever runs while the freezable workqueue is still frozen, e.g. device removal during the resume window, before workqueues are thawed. This issue was found by an in-house static analysis tool.
Title		tty: serial: max3100: shut down timer before freeing port
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/247b8f680876313586aed4d267bfcceddc2b4901 https://git.kernel.org/stable/c/2c8614981d3e6e000427de0ab2426ab68274d850 https://git.kernel.org/stable/c/db0949bbd06db0a75b4b1076f1e25194be7d956a https://git.kernel.org/stable/c/fb668620e3b163962dabe1a674725a07aa44ff4a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:47:34.347Z

Updated: 2026-10-30T12:39:19.454Z

Reserved: 2026-09-25T10:25:14.368Z

Link: CVE-2026-98749

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:28.660

Modified: 2026-10-30T13:21:23.600

Link: CVE-2026-98749

Redhat

Severity : Moderate

Publid Date: 2026-10-18T15:47:34Z

Links: CVE-2026-98749 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T22:00:16Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object