CVE-2026-45866

Schwachstellenklasse

In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] <-- race window --> caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, prev

Betroffene Produkte

• linux linux_kernel

Quellen

• https://git.kernel.org/stable/c/308e7e4d0a846359685f40aade023aee7b27284c
• https://git.kernel.org/stable/c/331e2b7051635780edea248dd08ae2026c126f4a
• https://git.kernel.org/stable/c/40962f2bf8cdba63af23aec95ad3f49b689e58e2
• https://git.kernel.org/stable/c/4e63d6f68544ae5269ac9735ae5b69b59b5b8725
• https://git.kernel.org/stable/c/52731ef4438155cea782fac74e547a327ab9e7c5
• https://git.kernel.org/stable/c/5e266ba8d330d3b8e5bc198f238cd8901826cfa1