CVE-2026-43458 Details
Description
In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing.
A use-after-free vulnerability has been identified in the Linux kernel's handling of TTY link references within the CAIF serial line discipline. This issue leads to a slab-use-after-free condition, which can be triggered by a specific reproducer. The vulnerability arises when the CAIF serial transmission path interacts with the TTY writing room, causing a faulting access on the TTY link port. The root cause is the improper management of reference counts for TTY link objects, which are crucial for maintaining the integrity of the TTY subsystem.
The vulnerability has been addressed by modifying the CAIF serial line discipline to properly manage TTY link references. The fix involves holding an additional reference on the TTY link for the duration of the CAIF serial line discipline's operation. This change ensures that the TTY link object remains valid while in use, preventing the use-after-free condition. Users should apply the latest patches available in the Linux kernel stable tree to mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98 | kernel.org | Patch |
| https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a | kernel.org | Patch |
| https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c | kernel.org | Patch |
| https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d | kernel.org | Patch |
| https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089 | kernel.org | Patch |
| https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.35, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.167 >= 6.2, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | kernel.org |