cbcvebase.
CVE-2026-45866
published 2026-05-27

CVE-2026-45866: In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
5.6th percentile
In the Linux kernel, the following vulnerability has been resolved: serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, preventing the UAF. Note: We save ser->tty before unregister_netdevice() because ser is embedded in netdev's private data and will be freed along with netdev (needs_free_netdev = true). How to reproduce: Add mdelay(500) at the beginning of ldisc_close() to widen the race window, then run the reproducer program [1]. Note: There is a separate deadloop issue in handle_tx() when using PORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper serial backend). This deadloop exists even without this patch, and is likely caused by inconsistency between uart_write_room() and uart_write() in serial core. It has been addressed in a separate patch [2]. KASAN report: BUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620 Read of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929 Call Trace:

Affected

57 ranges· showing 25
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 5e266ba8d330d3b8e5bc198f238cd8901826cfa15e266ba8d330d3b8e5bc198f238cd8901826cfa1
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < d3c75db4e0460641dbcd274b40867e252d801da1d3c75db4e0460641dbcd274b40867e252d801da1
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 4e63d6f68544ae5269ac9735ae5b69b59b5b87254e63d6f68544ae5269ac9735ae5b69b59b5b8725
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 331e2b7051635780edea248dd08ae2026c126f4a331e2b7051635780edea248dd08ae2026c126f4a
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 52731ef4438155cea782fac74e547a327ab9e7c552731ef4438155cea782fac74e547a327ab9e7c5
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < c8c197aaa56b25a2d54f3aa07e27e228d6c08546c8c197aaa56b25a2d54f3aa07e27e228d6c08546
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 40962f2bf8cdba63af23aec95ad3f49b689e58e240962f2bf8cdba63af23aec95ad3f49b689e58e2
linuxlinux>= 56e0ef527b184b3de2d7f88c6190812b2b2ac6bf < 308e7e4d0a846359685f40aade023aee7b27284c308e7e4d0a846359685f40aade023aee7b27284c
linuxlinux_kernel>= 3.11 < 5.10.2525.10.252
linuxlinux_kernel>= 5.11 < 5.15.2025.15.202
linuxlinux_kernel>= 5.16 < 6.1.1656.1.165
linuxlinux_kernel>= 6.13 < 6.18.146.18.14
linuxlinux_kernel>= 6.19 < 6.19.46.19.4
linuxlinux_kernel>= 6.2 < 6.6.1286.6.128
linuxlinux_kernel>= 6.7 < 6.12.756.12.75
ubuntulinux
ubuntulinux-aws
ubuntulinux-aws-5.15
ubuntulinux-aws-6.8
ubuntulinux-aws-fips
ubuntulinux-azure
ubuntulinux-azure-5.15
ubuntulinux-azure-6.8
ubuntulinux-azure-fde

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.