CVE-2026-93050

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Multiple issues occur in the ipoctal component when a device is removed while a tty session remains active. These include a Use-After-Free (UAF) of struct ipoctal because the remove callback frees the structure while tty operations may still access it, and a NULL pointer dereference in the ipoctal write tty() function when xmit buf is freed while a userspace process still holds the tty file descriptor and calls write. Additionally, a UAF exists in ipoctal cleanup() where ipack put carrier() dereferences ipoctal->dev after the ipack device has been freed by ipack device del(). To prevent page faults when devm ioremap() regions are unmapped, a removed flag is implemented in struct ipoctal and checked across various tty operations including port activate, write tty, set termios, hangup, and shutdown.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.