ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93050
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:17:58 UTC
Updated2026-09-17 17:17:58 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses kref_put() instead of kfree(). 2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove() frees xmit_buf via tty_port_free_xmit_buf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmit_buf in ipoctal_write_tty(). 3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev) dereferences ipoctal->dev after the ipack_device has been freed by ipack_device_del(). Fix by caching ipoctal->carrier_owner during probe() and calling module_put() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev. Also introduce a "removed" flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown). This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a git Not specified
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 c92ef8fd834521f0b788e0511976c689fe57c63c git Not specified
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 a4613140f01bd0fb9980e2746ed9aaa65a29b5d6 git Not specified
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 1a3258e105f711538201bdd2ac2a05b11554eabc git Not specified
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 4a6518be316029650301f2a5e8f0def229b895d9 git Not specified
CNA Linux Linux affected 05e5027efc9c0bb6d1d04cde279afbafca0a7929 b6b5d64cb161a28347d64dc3168a636c4abb68d5 git Not specified
CNA Linux Linux affected 3.8 Not specified
CNA Linux Linux unaffected 3.8 semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a4613140f01bd0fb9980e2746ed9aaa65a29b5d6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1a3258e105f711538201bdd2ac2a05b11554eabc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4a6518be316029650301f2a5e8f0def229b895d9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c92ef8fd834521f0b788e0511976c689fe57c63c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b6b5d64cb161a28347d64dc3168a636c4abb68d5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report