UBUNTU-CVE-2026-93050: Use After Free
In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses krefput() instead of kfree(). 2. NULL dereference in ipoctalwritetty(): ipoctalremove() frees xmitbuf via ttyportfreexmitbuf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmitbuf in ipoctalwritetty(). 3. UAF in ipoctalcleanup(): ipackputcarrier(ipoctal->dev) dereferences ipoctal->dev after the ipackdevice has been freed by ipackdevicedel(). Fix by caching ipoctal->carrierowner during probe() and calling moduleput() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev. Also introduce a "removed" flag in struct ipoctal, set at the start of ipoctalremove(), and checked in every tty op that accesses hardware resources (portactivate, writetty, settermios, hangup, shutdown). This prevents page faults when devmioremap() regions are unmapped after remove() returns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In struct ipoctal, introduce a "removed" flag, set it at the start of __ipoctal_remove(), and check it in port_activate, write_tty, set_termios, hangup, and shutdown before accessing hardware resources.
- Compensating control
In ipoctal_write_tty(), check for a NULL xmit_buf before using it.
- Compensating control
Cache ipoctal->carrier_owner during probe() and call module_put() directly on the cached pointer during cleanup(), avoiding access to ipoctal->dev.
- Compensating control
Introduce kref-based lifetime management: take a kref in install() when a tty is opened, release it in cleanup() when the tty is finally destroyed, and use kref_put() instead of kfree() in remove().