https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 01:40:50 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46098 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: caif: clear client service pointer on teardown</p> <p>`caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer-&gt;dn`, but leaves that pointer stale.</p> <p>When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer.</p> <p>Clear the client/service links before releasing the service object so repeated teardown becomes harmless.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: caif: clear client service pointer on teardown</p> <p>`caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer-&gt;dn`, but leaves that pointer stale.</p> <p>When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer.</p> <p>Clear the client/service links before releasing the service object so repeated teardown becomes harmless.</p> https://vulnerability.circl.lu/vuln/cve-2026-46098