CVE-2026-43458 serial: caif: hold tty->link reference in ldisc_open and ser_release
A use-after-free in the Linux kernel's CAIF serial driver allows attackers to trigger memory corruption, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43458?
CVE-2026-43458 is a high-severity use after free vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
serial: caif: hold tty->link reference in ldisc_open and ser_release
A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in my testing.
Weakness: CWE-416
Which versions are affected by CVE-2026-43458?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43458?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-43458 being exploited?
There is no known exploitation of CVE-2026-43458 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43458, DEBIAN-CVE-2026-43458, GHSA-27j8-6q5h-m6jx, ROOT-OS-DEBIAN-11-CVE-2026-43458, ROOT-OS-UBUNTU-2204-CVE-2026-43458, ROOT-OS-UBUNTU-2404-CVE-2026-43458 and 1 more.