PT-2026-43966 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46098

NVD

In the Linux kernel, the following vulnerability has been resolved:

net: caif: clear client service pointer on teardown

caif connect() can tear down an existing client after remote shutdown by calling caif disconnect client() followed by caif free client(). caif free client() releases the service layer referenced by adap layer->dn, but leaves that pointer stale.

When the socket is later destroyed, caif sock destructor() calls caif free client() again and dereferences the freed service pointer.

Clear the client/service links before releasing the service object so repeated teardown becomes harmless.

Related Identifiers

CVE-2026-46098

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46098 · Security Note
• https://git.kernel.org/stable/c/3ac6db584d9d420267bb8413115707eeec76d9cf · Note
• https://git.kernel.org/stable/c/f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8 · Note
• https://git.kernel.org/stable/c/914c6456fcfc21a3d553945dff62fd1621d6155d · Note
• https://git.kernel.org/stable/c/a4b191ddc12c55ddb62feb096536f819f384d6f1 · Note
• https://git.kernel.org/stable/c/63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9 · Note