Medium severity5.5NVD Advisory· Published May 27, 2026· Updated Jun 25, 2026
CVE-2026-46098
CVE-2026-46098
Description
In the Linux kernel, the following vulnerability has been resolved:
net: caif: clear client service pointer on teardown
caif_connect() can tear down an existing client after remote shutdown by calling caif_disconnect_client() followed by caif_free_client(). caif_free_client() releases the service layer referenced by adap_layer->dn, but leaves that pointer stale.
When the socket is later destroyed, caif_sock_destructor() calls caif_free_client() again and dereferences the freed service pointer.
Clear the client/service links before releasing the service object so repeated teardown becomes harmless.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords2 versions
>= 3.0.0, < 5.10.258+ 1 more
- (no CPE)range: >= 3.0.0, < 5.10.258
- (no CPE)range: < 7.0.11-1.1
Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/3ac6db584d9d420267bb8413115707eeec76d9cfnvdPatch
- git.kernel.org/stable/c/63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9nvdPatch
- git.kernel.org/stable/c/7ef97d4675b05a103648bd9244d91dff7d8c08b0nvdPatch
- git.kernel.org/stable/c/914c6456fcfc21a3d553945dff62fd1621d6155dnvdPatch
- git.kernel.org/stable/c/a4b191ddc12c55ddb62feb096536f819f384d6f1nvdPatch
- git.kernel.org/stable/c/cffca7a18b8f9de7c3d3013a1f5740c412b2a501nvdPatch
- git.kernel.org/stable/c/e16859f3f4426fa349bc5519d582a93d28f5a15dnvdPatch
- git.kernel.org/stable/c/f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8nvdPatch
News mentions
0No linked articles in our index yet.