CVE-2026-46098

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the caif connect() function where a client is torn down after a remote shutdown by calling caif disconnect client() and caif free client(). The caif free client() function releases the service layer referenced by adap layer->dn but fails to clear the pointer, leaving it stale. Consequently, when the socket is destroyed, caif sock destructor() invokes caif free client() again, leading to a dereference of the freed service pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.