The Linux kernel's caif_serial driver contained a use-after-free vulnerability (CVE-2026-45866) caused by a race condition between ldisc_close() and packet transmission. Specifically, tty_kref_put() was called in ldisc_close() while the network device was still active, potentially freeing the tty structure prematurely. Concurrently, handle_tx() could access the freed tty pointer, leading to a use-after-free bug. The fix involves moving the tty reference release from ldisc_close() to ser_release(), which occurs after unregister_netdevice(), ensuring the tty reference remains valid while the network device exists. This resolves the race condition and prevents the use-after-free. The vulnerability was identified and confirmed by KASAN reports and detailed kernel debugging.

This vulnerability allows a use-after-free condition in the Linux kernel's caif_serial driver, which can lead to kernel memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), meaning exploitation could result in full system compromise or denial of service. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves deferring the tty reference release to ser_release() after unregister_netdevice(). Until an official patch is applied, avoid using the affected caif_serial driver or apply any vendor-provided updates that address this issue. Monitor vendor advisories for the release of an official fix.