CVE-2026-45866

kernel: serial: caif: fix use-after-free in caif_serial ldisc_close()

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 27, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's CAIF serial line discipline. A race condition exists between the ldisc_close() function, which frees the terminal (tty) device, and the handle_tx() function, which may attempt to access the freed device. This use-after-free (UAF) vulnerability allows a local attacker to potentially cause system instability or execute arbitrary code.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-364 · Signal Handler Race Condition