CVE-2026-45866: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45866 Overview

CVE-2026-45866 is a use-after-free vulnerability in the Linux kernel's CAIF (Communication CPU to Application CPU Interface) serial line discipline driver. The flaw exists in the caif_serial subsystem where handle_tx() can access ser->tty after the underlying tty structure has been freed by ldisc_close(). A race condition between line discipline close and packet transmission creates a window where dangling pointer dereference occurs, triggering kernel memory corruption. The vulnerability is confirmed by KASAN reports showing slab-use-after-free reads against freed memory regions.

Critical Impact
Local attackers with access to CAIF serial devices can trigger kernel memory corruption, leading to denial of service or potential privilege escalation through use-after-free exploitation.

Affected Products

Linux kernel versions containing the caif_serial line discipline driver prior to the fix
Distributions shipping affected stable kernel trees referenced in upstream commits
Systems with CAIF networking subsystem enabled (CONFIG_CAIF_TTY)

Discovery Timeline

2026-05-27 - CVE-2026-45866 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45866

Vulnerability Analysis

The vulnerability resides in the caif_serial driver, which bridges CAIF network packets over TTY line disciplines. Each ser instance has a 1:1 binding to a tty structure with linked lifecycles. The race occurs because ldisc_close() releases the tty reference via tty_kref_put(ser->tty) while the associated network device remains registered and able to receive packets for transmission.

When caif_xmit() is invoked concurrently on another CPU, it calls handle_tx(), which reads tty = ser->tty and subsequently invokes tty->ops->write(). If the close path has already freed the tty between the reference drop and the transmit path's access, the write operation dereferences freed memory. KASAN confirms a 1-byte read at offset 1168 inside a freed 2048-byte kmalloc-cg-2k region.

Root Cause

The root cause is incorrect lifecycle management of the tty reference relative to the network device. tty_kref_put() is called too early in ldisc_close(), while unregister_netdevice() is deferred to a workqueue via schedule_work() calling ser_release(). Between these two events, the netdev remains live and can dispatch packets that dereference the now-freed tty pointer.

Attack Vector

An attacker with local access to a CAIF-enabled TTY device can race line discipline detachment against active packet transmission. The reproducer widens the race window by inserting mdelay(500) at the start of ldisc_close(), then issues sendto() syscalls against a packet socket bound to the CAIF netdev. Successful exploitation requires the ability to open the TTY and configure the N_CAIF line discipline, then trigger concurrent xmit and close operations.

The fix moves tty_kref_put() from ldisc_close() into ser_release(), executed after unregister_netdevice() completes. This guarantees the tty reference outlives the network device, eliminating the dangling pointer window. The patched ser pointer is saved before netdev release because ser is embedded in netdev private data with needs_free_netdev = true.

Detection Methods for CVE-2026-45866

Indicators of Compromise

KASAN reports indicating slab-use-after-free in handle_tx in kernel logs
Unexpected kernel oops or panics referencing caif_serial, handle_tx, or ldisc_close in stack traces
Crash signatures showing dev_hard_start_xmit followed by handle_tx faults
Unusual usage of the N_CAIF line discipline on systems that do not normally use CAIF

Detection Strategies

Audit kernel dmesg and /var/log/kern.log for KASAN slab-use-after-free reports referencing the CAIF subsystem
Monitor TIOCSETD ioctl calls that set line discipline to N_CAIF on unexpected TTY devices
Track creation and destruction of caif* network interfaces via netlink monitoring
Detect repeated rapid open and close sequences on TTY devices coupled with packet socket activity

Monitoring Recommendations

Enable KASAN on test or canary kernels to surface use-after-free conditions before production exploitation
Deploy eBPF probes on tty_kref_put and caif_xmit to correlate close and transmit ordering anomalies
Forward kernel crash dumps to a centralized log platform for cross-host correlation of CAIF-related faults
Alert on processes that combine TTY ioctl manipulation with raw packet socket usage

How to Mitigate CVE-2026-45866

Immediate Actions Required

Apply the upstream Linux stable kernel patches referenced in the kernel.org git commits for affected branches
Disable the CAIF subsystem on systems that do not require it by unloading caif_serial and blacklisting the module
Restrict access to TTY devices and CAIF netdevs through filesystem permissions and user namespace policies
Audit running systems for unauthorized use of the N_CAIF line discipline

Patch Information

The fix is distributed across multiple stable kernel branches. Relevant commits include 308e7e4d0a84, 331e2b705163, 40962f2bf8cd, 4e63d6f68544, 52731ef44381, 5e266ba8d330, c8c197aaa56b, and d3c75db4e046. The patch relocates tty_kref_put() from ldisc_close() to ser_release() after unregister_netdevice().

Workarounds

Blacklist the caif_serial kernel module on systems that do not require CAIF connectivity
Remove CAP_SYS_ADMIN and TTY device access from untrusted users to prevent line discipline manipulation
Use kernel lockdown mode where supported to restrict module loading and reduce attack surface

bash

# Blacklist caif_serial module to prevent loading
echo "blacklist caif_serial" | sudo tee /etc/modprobe.d/blacklist-caif.conf
echo "install caif_serial /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-caif.conf
sudo rmmod caif_serial 2>/dev/null
sudo update-initramfs -u