---
id: CVE-2026-93050
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on
  remove


  Three issues arise when the device is removed while a tty session is

  still active:


  1.…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on
  remove


  Three issues arise when the device is removed while a tty session is

  still active:


  1.…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    c92ef8fd834521f0b788e0511976c689fe57c63c
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    a4613140f01bd0fb9980e2746ed9aaa65a29b5d6
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    1a3258e105f711538201bdd2ac2a05b11554eabc
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    4a6518be316029650301f2a5e8f0def229b895d9
  - >-
    Linux >= 05e5027efc9c0bb6d1d04cde279afbafca0a7929 <
    b6b5d64cb161a28347d64dc3168a636c4abb68d5
  - Linux 3.8
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:58.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93050'
references:
  - url: 'https://git.kernel.org/stable/c/1a3258e105f711538201bdd2ac2a05b11554eabc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4a6518be316029650301f2a5e8f0def229b895d9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a4613140f01bd0fb9980e2746ed9aaa65a29b5d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b6b5d64cb161a28347d64dc3168a636c4abb68d5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c92ef8fd834521f0b788e0511976c689fe57c63c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.771Z'
epss: 0.00205
epssPercentile: 0.10897
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

Three issues arise when the device is removed while a tty session is
still active:

1. UAF of struct ipoctal: the remove callback frees ipoctal via
   kfree() while tty ops may still access it.  Fix by introducing
   kref-based lifetime management — kref is taken in install() when
   a tty is opened and released in cleanup() when the tty is finally
   destroyed; remove() uses kref_put() instead of kfree().

2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()
   frees xmit_buf via tty_port_free_xmit_buf() while a userspace
   process may still hold the tty fd and call write().  Fix by
   checking for NULL xmit_buf in ipoctal_write_tty().

3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev)
   dereferences ipoctal->dev after the ipack_device has been freed
   by ipack_device_del().  Fix by caching ipoctal->carrier_owner
   during probe() and calling module_put() on the cached pointer
   directly in cleanup(), avoiding any access to ipoctal->dev.

Also introduce a "removed" flag in struct ipoctal, set at the start
of __ipoctal_remove(), and checked in every tty op that accesses
hardware resources (port_activate, write_tty, set_termios, hangup,
shutdown).  This prevents page faults when devm_ioremap() regions
are unmapped after remove() returns.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.