{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-93050",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-93050",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-17T16:10:40.360Z",
    "updatedAt": "2026-10-19T09:04:45.286Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove\n\nThree issues arise when the device is removed while a tty session is\nstill active:\n\n1. UAF of struct ipoctal: the remove callback frees ipoctal via\n   kfree() while tty ops may still access it.  Fix by introducing\n   kref-based lifetime management — kref is taken in install() when\n   a tty is opened and released in cleanup() when the tty is finally\n   destroyed; remove() uses kref_put() instead of kfree().\n\n2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()\n   frees xmit_buf via tty_port_free_xmit_buf() while a userspace\n   process may still hold the tty fd and call write().  Fix by\n   checking for NULL xmit_buf in ipoctal_write_tty().\n\n3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev)\n   dereferences ipoctal->dev after the ipack_device has been freed\n   by ipack_device_del().  Fix by caching ipoctal->carrier_owner\n   during probe() and calling module_put() on the cached pointer\n   directly in cleanup(), avoiding any access to ipoctal->dev.\n\nAlso introduce a \"removed\" flag in struct ipoctal, set at the start\nof __ipoctal_remove(), and checked in every tty op that accesses\nhardware resources (port_activate, write_tty, set_termios, hangup,\nshutdown).  This prevents page faults when devm_ioremap() regions\nare unmapped after remove() returns.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ab5f5b27a340004b92252c6a5f23bf1c6cf3b02a"
            },
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c92ef8fd834521f0b788e0511976c689fe57c63c"
            },
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a4613140f01bd0fb9980e2746ed9aaa65a29b5d6"
            },
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1a3258e105f711538201bdd2ac2a05b11554eabc"
            },
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4a6518be316029650301f2a5e8f0def229b895d9"
            },
            {
              "version": "05e5027efc9c0bb6d1d04cde279afbafca0a7929",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b6b5d64cb161a28347d64dc3168a636c4abb68d5"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.8",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.8"
            },
            {
              "version": "6.1.188",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.157",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.110",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.52",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}