GHSA-7QCC-HQRM-QFRJ
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
Three issues arise when the device is removed while a tty session is still active:
-
UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses kref_put() instead of kfree().
-
NULL dereference in ipoctal_write_tty(): __ipoctal_remove() frees xmit_buf via tty_port_free_xmit_buf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmit_buf in ipoctal_write_tty().
-
UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev) dereferences ipoctal->dev after the ipack_device has been freed by ipack_device_del(). Fix by caching ipoctal->carrier_owner during probe() and calling module_put() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev.
Also introduce a "removed" flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown). This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.
{
"affected": [],
"aliases": [
"CVE-2026-93050"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:58Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove\n\nThree issues arise when the device is removed while a tty session is\nstill active:\n\n1. UAF of struct ipoctal: the remove callback frees ipoctal via\n kfree() while tty ops may still access it. Fix by introducing\n kref-based lifetime management \u2014 kref is taken in install() when\n a tty is opened and released in cleanup() when the tty is finally\n destroyed; remove() uses kref_put() instead of kfree().\n\n2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()\n frees xmit_buf via tty_port_free_xmit_buf() while a userspace\n process may still hold the tty fd and call write(). Fix by\n checking for NULL xmit_buf in ipoctal_write_tty().\n\n3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal-\u003edev)\n dereferences ipoctal-\u003edev after the ipack_device has been freed\n by ipack_device_del(). Fix by caching ipoctal-\u003ecarrier_owner\n during probe() and calling module_put() on the cached pointer\n directly in cleanup(), avoiding any access to ipoctal-\u003edev.\n\nAlso introduce a \"removed\" flag in struct ipoctal, set at the start\nof __ipoctal_remove(), and checked in every tty op that accesses\nhardware resources (port_activate, write_tty, set_termios, hangup,\nshutdown). This prevents page faults when devm_ioremap() regions\nare unmapped after remove() returns.",
"id": "GHSA-7qcc-hqrm-qfrj",
"modified": "2026-09-17T18:32:08Z",
"published": "2026-09-17T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93050"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a3258e105f711538201bdd2ac2a05b11554eabc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4a6518be316029650301f2a5e8f0def229b895d9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a4613140f01bd0fb9980e2746ed9aaa65a29b5d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6b5d64cb161a28347d64dc3168a636c4abb68d5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c92ef8fd834521f0b788e0511976c689fe57c63c"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.