CVE-2026-46098

Analyzed Analyzed - Analysis Complete

Double Free in Linux Kernel CAIF

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46098

EUVD

EUVD-2026-32481

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 3.0 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by clearing the client/service pointers before releasing the service object to prevent stale pointer dereferences.

To mitigate this vulnerability immediately, you should update your Linux kernel to the fixed version that includes this patch.

Executive Summary

This vulnerability exists in the Linux kernel's CAIF network subsystem. Specifically, when a client connection is torn down using the caif_connect() function, it calls caif_disconnect_client() and then caif_free_client(). The caif_free_client() function releases the service layer referenced by adap_layer->dn but leaves the pointer stale (dangling). Later, when the socket is destroyed, caif_sock_destructor() calls caif_free_client() again and attempts to dereference this already freed service pointer, which can lead to undefined behavior or crashes.

The fix involves clearing the client/service pointers before releasing the service object, making repeated teardown operations safe and preventing the use of stale pointers.

Impact Analysis

This vulnerability can cause the Linux kernel to dereference a freed pointer during socket destruction, potentially leading to kernel crashes or system instability. Such behavior can be exploited to cause denial of service by crashing the system or disrupting network communications.

Hi! I’m here to help you understand CVE-2026-46098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70