CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved:

bna: prevent IOC timer rearm during teardown

bna: prevent IOC timer rearm during teardown

bnad pci remove() and the probe disable ioceth path call timer delete sync() for ioc timer, sem timer and hb timer, but not for iocpf timer. bnad iocpf timeout() then takes bnad->bna lock after free netdev() has freed the struct bnad.

Deleting iocpf timer last does not fix this. sem timer and iocpf timer rearm each other: bnad iocpf sem timeout() can arm iocpf timer, and bnad iocpf timeout() arms sem timer from bfa ioc hw sem get() when the semaphore is busy. timer delete sync() only waits out its own callback. bnad ioceth disable() can time out and leave that callback live.

Shut all four IOC timers down with timer shutdown sync() on both paths, so a later mod timer() is ignored.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.