The Linux kernel’s caif networking module contains a use‑after‑free flaw that triggers when a client connection is torn down after a remote shutdown. The caif_disconnect_client() and caif_free_client() functions release a service object while leaving the adap_layer->dn pointer still referencing the freed memory. Subsequent calls to caif_sock_destructor() invoke caif_free_client() again and dereference this stale pointer, causing a kernel panic (CVE-2026-46098). The flaw is classified under CWE‑416 (Use‑After‑Free) and CWE‑1341 (Improper Release of Resource).

All Linux kernel builds that include the caif networking support are potentially vulnerable. No specific kernel version numbers are listed, so any kernel that incorporates the caif module may be affected until the patch that clears the client/service links before freeing the service object is applied.

Because the exploit requires local kernel access through caif APIs, it is a local privilege escalation or denial‑of‑service risk. An attacker with sufficient privileges can deliberately initiate a remote shutdown to trigger the dangling dereference, resulting in a kernel crash. No EPSS or KEV indicators are available, but the severity of a kernel panic warrants immediate remediation. Applying the kernel update that removes the dangling pointer mitigates the risk.