Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-43458— serial: caif: hold tty->link reference in ldisc_open and ser_release

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-43458

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
serial: caif: hold tty->link reference in ldisc_open and ser_release
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux e31d5a05948e4478ba8396063d1e1f39880928e2 ~ 23a3ac2e2262a291498567418227b99e1f3606b1 -
LinuxLinux 2.6.35 -

II. Public POCs for CVE-2026-43458

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43458

Please Login to view more intelligence information

Same Patch Batch · Linux · 2026-05-08 · 199 CVEs total

CVE-2026-43337drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
CVE-2026-43349f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
CVE-2026-43348mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER
CVE-2026-43347arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
CVE-2026-43346ice: ptp: don't WARN when controlling PF is unavailable
CVE-2026-43345net: ipa: fix event ring index not programmed for IPA v5.0+
CVE-2026-43344perf/x86/intel/uncore: Fix die ID init and look up bugs
CVE-2026-43343usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
CVE-2026-43342usb: gadget: f_rndis: Protect RNDIS options with mutex
CVE-2026-43340comedi: Reinit dev->spinlock between attachments to low-level drivers
CVE-2026-43341net/ipv6: ioam6: prevent schema length wraparound in trace fill
CVE-2026-43339ipv6: prevent possible UaF in addrconf_permanent_addr()
CVE-2026-43338btrfs: reserve enough transaction items for qgroup ioctls
CVE-2026-43331x86/kexec: Disable KCOV instrumentation after load_segments()
CVE-2026-43325wifi: iwlwifi: mvm: don't send a 6E related command when not supported
CVE-2026-43327USB: dummy-hcd: Fix locking/synchronization error
CVE-2026-43329netfilter: flowtable: strictly check for maximum number of actions
CVE-2026-43328cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
CVE-2026-43330crypto: caam - fix overflow on long hmac keys
CVE-2026-43334Bluetooth: SMP: force responder MITM requirements before building the pairing response

Showing top 20 of 199 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43458

No comments yet

Leave a comment