The Linux kernel’s caif networking module contains a use‑after‑free flaw that triggers when a client connection is torn down after a remote shutdown. The caif_disconnect_client() and caif_free_client() functions release a service object while leaving the adap_layer->dn pointer still referencing the freed memory. Subsequent calls to caif_sock_destructor() invoke caif_free_client() again and dereference this stale pointer, causing a kernel panic. This flaw is classified under CWE‑1341 (Improper Release of Resource) and represents a NULL pointer dereference (CWE‑476).

All Linux kernel builds that include the caif networking support are potentially vulnerable. No specific kernel version numbers are listed, so any kernel that incorporates the caif module may be affected until the patch that clears the client/service links before freeing the service object is applied.

The CVSS score for this issue is 5.5. The EPSS score is less than 1%, indicating a very low likelihood of exploitation. While the CVE description does not explicitly state the required access level, it is inferred that local kernel access would likely be necessary to manipulate caif APIs and trigger the dangling dereference, which would result in a kernel crash. No KEV indicators are available, but the severity of a kernel panic warrants immediate remediation. Applying the kernel update that removes the dangling pointer mitigates the risk.