CVE-2026-93050: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
Three issues arise when the device is removed while a tty session is still active:
1. UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses krefput() instead of kfree().
2. NULL dereference in ipoctalwritetty(): ipoctalremove() frees xmitbuf via ttyportfreexmitbuf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmitbuf in ipoctalwritetty().
3. UAF in ipoctalcleanup(): ipackputcarrier(ipoctal->dev) dereferences ipoctal->dev after the ipackdevice has been freed by ipackdevicedel(). Fix by caching ipoctal->carrierowner during probe() and calling moduleput() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev.
Also introduce a "removed" flag in struct ipoctal, set at the start of ipoctalremove(), and checked in every tty op that accesses hardware resources (portactivate, writetty, settermios, hangup, shutdown). This prevents page faults when devmioremap() regions are unmapped after remove() returns.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel changes described: add a removed flag in struct ipoctal set at start; cache ipoctal->carrier_owner; in ipoctal_write_tty() check for NULL xmit_buf before use; ensure tty ops check kref/lifetime (kref taken in install(), checked in every tty op) and avoid dereferencing ipoctal->dev after ipack_device is freed; in ipoctal_cleanup() avoid UAF by not calling ipack_put_carrier(ipoctal->dev) after dev is freed; use kref_put() instead of kfree() in the remove path; avoid accessing ipoctal->dev after remove() returns by ensuring unmapping of devm_ioremap regions happens safely.
Linux kernel (ipoctal) NULL dereference / UAF fixes in ipoctal: __ipoctal_remove(), ipoctal_cleanup(), ipoctal_write_tty() = Apply the vendor-described fixes: null-check xmit_buf, cache ipoctal->carrier_owner for remove(), introduce kref-based lifetime management using kref_put instead of kfree, and avoid accessing ipoctal->dev after ipack_device is freed (checking removed flag and guarding tty ops)
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Systems using the ipack ipoctal driver should be prioritized if the associated device can be removed while an ipoctal tty session remains active. The affected condition involves active tty users during device removal.
What access or timing is needed to trigger the write-related issue?
A userspace process must still hold an open tty file descriptor after device removal and call write(). Device removal can free the transmit buffer before that write occurs, requiring the driver to handle the missing buffer safely.