Linux Kernel Client Service Pointer Vulnerability in Network Module

CVE-2026-46098

What is CVE-2026-46098?

A vulnerability in the Linux kernel's network module impacts how client services are managed during teardown operations. Specifically, when the caif_connect() function is called to dismantle an existing client after a remote shutdown, it utilizes caif_disconnect_client() followed by caif_free_client(). Despite correctly freeing the service layer, the service pointer remains stale, which can lead to dereferencing issues when the corresponding socket is later destroyed. To mitigate this risk, the client and service links should be cleared prior to releasing the service object, ensuring that repeat teardown processes do not introduce security vulnerabilities.

References