Executive brief
A vulnerability exists in the Linux kernel's CAIF serial driver that could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs because the system incorrectly manages memory references for serial communication components, leading to a 'use-after-free' condition. This could impact system stability and the confidentiality of data handled by the affected driver.
Technical details
A slab-use-after-free vulnerability exists in the Linux kernel's CAIF serial line discipline implementation. The root cause is a failure to maintain a proper reference count (kref) on the 'tty->link' object during the lifetime of the caif_serial line discipline. When the TX path calls tty_write_room(), it may attempt to access a 'tty->link->port' structure that has already been freed. An attacker with local access can exploit this by triggering the race condition or improper cleanup sequence, leading to memory corruption. The fix involves holding an extra kref on tty->link in ldisc_open() and releasing it in ser_release().
Affected products
- Linux Linux kernel 2.6.35 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-05: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD advisory updated with analysis
References
- https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1
- https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98
- https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a
- https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c
- https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d
- https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089
- https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7