CVE-2026-43458: serial: caif: hold tty->link reference in ldisc_open and ser_release
In the Linux kernel, the following vulnerability has been resolved:
serial: caif: hold tty->link reference in ldiscopen and serrelease
A reproducer triggers a KASAN slab-use-after-free in ptywriteroom() when caifserial's TX path calls ttywriteroom(). The faulting access is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caifserial line discipline: get it in ldiscopen() and drop it in serrelease(), and also drop it on the ldiscopen() error path.
With this change applied, the reproducer no longer triggers the UAF in my testing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43458?
The severity of CVE-2026-43458 is categorized as a medium vulnerability due to the potential for a KASAN slab-use-after-free exploit.
How do I fix CVE-2026-43458?
To fix CVE-2026-43458, update the Linux kernel to the latest stable version where this vulnerability has been resolved.
What systems are affected by CVE-2026-43458?
CVE-2026-43458 affects the Linux kernel, particularly impacting systems using the caif_serial functionality.
What causes the vulnerability CVE-2026-43458?
CVE-2026-43458 is caused by a failure to properly manage the tty->link reference in ldisc_open and ser_release functions.
Can CVE-2026-43458 be exploited remotely?
Yes, CVE-2026-43458 can be exploited remotely under certain conditions, allowing attackers to potentially execute code.