CVE-2026-46098

Description

In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless.

Is your site exposed to CVE-2026-46098?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/3ac6db584d9d420267bb8413115707eeec76d9cf https://git.kernel.org/stable/c/63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9 https://git.kernel.org/stable/c/7ef97d4675b05a103648bd9244d91dff7d8c08b0 https://git.kernel.org/stable/c/914c6456fcfc21a3d553945dff62fd1621d6155d https://git.kernel.org/stable/c/a4b191ddc12c55ddb62feb096536f819f384d6f1 https://git.kernel.org/stable/c/cffca7a18b8f9de7c3d3013a1f5740c412b2a501 https://git.kernel.org/stable/c/e16859f3f4426fa349bc5519d582a93d28f5a15d https://git.kernel.org/stable/c/f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8

Frequently Asked Questions

What is CVE-2026-46098? +

In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless.

How do I check if I'm vulnerable to CVE-2026-46098? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.