Executive brief
A vulnerability was identified in the Linux kernel's CAIF (Communication CPU Interface) networking protocol. This component is responsible for communication between a host processor and a modem. An error in how the system cleans up network connections could allow a local attacker to cause a system crash or potentially execute unauthorized code by triggering a 'use-after-free' condition during connection teardown.
Technical details
A use-after-free vulnerability exists in the Linux kernel's CAIF implementation within net/caif/cfsrvl.c. The function caif_free_client() releases the service layer referenced by adap_layer->dn but fails to nullify the pointer. Consequently, when the socket is later destroyed, caif_sock_destructor() invokes caif_free_client() again, leading to a dereference of the previously freed service pointer. This can be triggered during a remote shutdown sequence where caif_connect() initiates teardown. The fix involves clearing the client/service links (setting the pointers to NULL) before releasing the service object to ensure subsequent teardown attempts are harmless.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-04-11: other: Vulnerability fix authored
- 2026-05-27: disclosed: CVE published by NVD
- 2026-05-07: patched: Fix committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/3ac6db584d9d420267bb8413115707eeec76d9cf
- https://git.kernel.org/stable/c/63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9
- https://git.kernel.org/stable/c/914c6456fcfc21a3d553945dff62fd1621d6155d
- https://git.kernel.org/stable/c/a4b191ddc12c55ddb62feb096536f819f384d6f1
- https://git.kernel.org/stable/c/f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8