CVE-2026-46098

A flaw was found in the Linux kernel's CAIF network module. When a client is torn down, the `caif_free_client()` function frees a service pointer but leaves it in a stale state. If the socket is later destroyed, `caif_free_client()` may be called again, attempting to use the previously freed pointer. This can lead to memory corruption and potentially cause a system crash, resulting in a Denial of Service (DoS).