High 7.8Published May 8, 2026

CVE-2026-43458serial: caif: hold tty->link reference in ldisc_open and ser_release

Updated under an hour ago (Oct 26, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e31d5a05948e4478ba8396063d1e1f39880928e2 before 23a3ac2e2262a291498567418227b99e1f3606b1; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 52135420e9f75853ea0c6cea7b736e3e98495f7d; from e31d5a05948e4478ba8396063d1e1f39880928e2 before ca2ceba983bb23ea0202c2882d963253416654a3; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 8460187b4852fd00bd1c76394358053f3fa4d089; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 27e43356d0defb9fc7fa25265219a3ffeb7b3e98; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 35b58d3bc716ebb9ebd10fe1cac8c1177242511c; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 97a0bb491cae39478c6225381f14e9ac67b7bba7; from e31d5a05948e4478ba8396063d1e1f39880928e2 before 288598d80a068a0e9281de35bcb4ce495f189e2a	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.35 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1	patch
https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d	patch
https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3	patch
https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089	patch
https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98	patch
https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c	patch
https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7	patch
https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.