CVE-2026-45866

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: fix use-after-free in caif_serial ldisc_close()

There is a use-after-free bug in caif_serial where handle_tx() may

access ser->tty after the tty has been freed.

The race condition occurs between ldisc_close() and packet transmission:

CPU 0 (close) CPU 1 (xmit)

------------- ------------

ldisc_close()

tty_kref_put(ser->tty)

[tty may be freed here]

<-- race window -->

caif_xmit()

handle_tx()

tty = ser->tty // dangling ptr

tty->ops->write() // UAF!

schedule_work()

ser_release()

unregister_netdevice()

The root cause is that tty_kref_put() is called in ldisc_close() while

the network device is still active and can receive packets.

Since

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References