HIGH
caif Client UAF
CVE-2026-46098
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless.
02KernelScan AI Analysis
Risk summary
Local attackers with low privileges can trigger a use-after-free vulnerability in the CAIF networking subsystem by causing double teardown of client connections. This can lead to kernel memory corruption, privilege escalation, or system crashes on devices using CAIF protocol stacks.
Vulnerability analysis
The vulnerability occurs in the CAIF (Communication CPU to Application CPU Interface) networking subsystem's client teardown logic. When caif_connect() tears down an existing client after remote shutdown, it calls caif_free_client() which releases the service layer object referenced by adap_layer->dn but leaves the pointer stale. Later, when the socket destructor caif_sock_destructor() calls caif_free_client() again, it dereferences the already-freed service pointer, causing a use-after-free condition. The fix clears both the client-to-service (adap_layer->dn) and service-to-client (serv_layer->up) pointers before releasing the service object, making repeated teardown operations safe by preventing access to freed memory.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.258 | cffca7a18b8f |
| 5.15 | 5.15.209 | 7ef97d4675b0 |
| 6.1 | 6.1.175 | e16859f3f442 |
| 6.12 | 6.12.86 | 3ac6db584d9d |
| 6.18 | 6.18.27 | 63d21a3aa010 |
| 6.6 | 6.6.140 | 914c6456fcfc |
| 7.0 | 7.0.4 | a4b191ddc12c |
| mainline | 7.1-rc1 | f7cf8ece8cee |