{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove  Three issues arise when the device is removed while a tty session is still active:  1. UAF of struct ipoctal: the remove callback frees ipoctal via    kfree() while tty ops may still access it.  Fix by introducing    kref-based lifetime management — kref is taken in install() when    a tty is opened and released in cleanup() when the tty is finally    destroyed; remove() uses kref_put() instead of kfree().  2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()    frees xmit_buf via tty_port_free_xmit_buf() while a userspace    process may still hold the tty fd and call write().  Fix by    checking for NULL xmit_buf in ipoctal_write_tty().  3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal-\u003edev)    dereferences ipoctal-\u003edev after the ipack_device has been freed    by ipack_device_del().  Fix by caching ipoctal-\u003ecarrier_owner    during probe() and calling module_put() on the cached pointer    directly in cleanup(), avoiding any access to ipoctal-\u003edev.  Also introduce a \"removed\" flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown).  This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.",
  "id": "DEBIAN-CVE-2026-93050",
  "modified": "2026-09-18T04:47:33.490780910Z",
  "published": "2026-09-17T17:17:58.367Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-93050"
    }
  ],
  "upstream": [
    "CVE-2026-93050"
  ]
}