Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93050

ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses kref_put() instead of kfree(). 2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove() frees xmit_buf via tty_port_free_xmit_buf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmit_buf in ipoctal_write_tty(). 3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev) dereferences ipoctal->dev after the ipack_device has been freed by ipack_device_del(). Fix by caching ipoctal->carrier_owner during probe() and calling module_put() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev. Also introduce a "removed" flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown). This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < ab5f5b27a340004b92252c6a5f23bf1c6cf3b02aaffected
  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < c92ef8fd834521f0b788e0511976c689fe57c63caffected
  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < a4613140f01bd0fb9980e2746ed9aaa65a29b5d6affected
  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < 1a3258e105f711538201bdd2ac2a05b11554eabcaffected
  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < 4a6518be316029650301f2a5e8f0def229b895d9affected
  • 05e5027efc9c0bb6d1d04cde279afbafca0a7929 to < b6b5d64cb161a28347d64dc3168a636c4abb68d5affected

Linux Linux

Default version status: affected

  • 3.8affected
  • 0 to < 3.8unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References