Executive brief
The Linux kernel's ipack ipoctal driver manages serial communication via industrial computer interface cards. When such a device is removed while a user still has an active serial session, the driver can dereference freed memory or invalid pointers, potentially causing a system crash or unexpected behavior affecting any application using the device at removal time.
Technical details
The vulnerability involves three memory safety issues in the ipoctal driver when a device is removed during active TTY operations: (1) use-after-free of the ipoctal struct when the remove callback frees it via kfree() while TTY operations may still reference it, (2) null pointer dereference in ipoctal_write_tty() when xmit_buf is freed but a userspace process still holds the TTY file descriptor and calls write(), and (3) use-after-free in ipoctal_cleanup() when ipack_put_carrier() dereferences ipoctal->dev after the ipack_device has been freed. The fix introduces kref-based lifetime management for the ipoctal struct, null checks for xmit_buf, caching of carrier_owner, and a "removed" flag checked in all TTY operations accessing hardware resources. No special privileges or network access are required—exploitation occurs during normal device removal concurrent with active TTY operations. The patch has been applied to the Linux kernel.
Affected products
- Linux Linux kernel all versions with ipack ipoctal driver (from kernel 3.x onward, fixed in stable branches)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-01: patched: Fix committed by Pei Xiao, merged to stable branches as of 2026-09-14