{
  "cveId": "CVE-2026-93050",
  "url": "https://patchblox.com/security/cve/CVE-2026-93050",
  "summary": "CVE-2026-93050 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-93050, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove  Three issues arise when the device is removed while a tty session is still active:  1. UAF of struct ipoctal: the remove callback frees ipoctal via    kfree() while tty ops may still access it.  Fix by introducing    kref-based lifetime management \u2014 kref is taken in install() when    a tty is opened and released in cleanup() when the tty is finally    destroyed; remove() uses kref_put() instead of kfree().  2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()    frees xmit_buf via tty_port_free_xmit_buf() while a userspace    process may still hold the tty fd and call write().  Fix by    checking for NULL xmit_buf in ipoctal_write_tty().  3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal-\u003Edev)    dereferences ipoctal-\u003Edev after the ipack_device has been freed    by ipack_device_del().  Fix by caching ipoctal-\u003Ecarrier_owner    during probe() and calling module_put() on the cached pointer    directly in cleanup(), avoiding any access to ipoctal-\u003Edev.  Also introduce a \u0022removed\u0022 flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown).  This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.",
  "published": "2026-09-17T17:17:58Z",
  "severity": "Moderate",
  "cvss": 7.1,
  "epss": 0.00205,
  "epssPercentile": 0.10612,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93050",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.190-1",
      "fix": "DEBIAN-CVE-2026-93050",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93050",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-93050",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93050",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93050",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93050",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.111-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-93050",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93050",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}