CVE-2026-98752

Received Received - Intake

Race Condition in Linux Kernel TTY Port Handling

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect). If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss). Add the missing serialisation to tty_port_tty_vhangup() and tty_port_hangup() so that the former does not return until the port has been shut down also when there is a racing hangup. Note that serial core does not use tty_port_hangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uart_hangup().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98752

EUVD

EUVD-2026-103837

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7ca0ff9ab3218ec443a7a9ad247e4650373ed41e
Linux	Linux	7ca0ff9ab3218ec443a7a9ad247e4650373ed41e
Linux	Linux	7ca0ff9ab3218ec443a7a9ad247e4650373ed41e
Linux	Linux	7ca0ff9ab3218ec443a7a9ad247e4650373ed41e
Linux	Linux	4260dc792fabfd20c8644fa9414b2ae48372365f
Linux	Linux	2.6.31.2
Linux	Linux	2.6.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the tty_port_tty_vhangup() function. It occurs when the function races with another hangup operation, potentially returning before the port is fully shut down. This can lead to use-after-free errors and NULL-pointer dereferences in racing ioctls or asynchronous hangups.

Detection Guidance

This vulnerability is specific to the Linux kernel's TTY subsystem and may not have direct network detection methods. Check kernel logs for tty-related errors or crashes using dmesg or journalctl. Look for race conditions or use-after-free errors in tty_port_tty_vhangup() or tty_port_hangup().

Commands to check: dmesg | grep -i tty, journalctl -k | grep -i tty, or inspect kernel logs for NULL-pointer dereferences or hangup-related issues.

Impact Analysis

This vulnerability may cause system crashes, data corruption, or privilege escalation if exploited. It affects drivers relying on tty_port_tty_vhangup() for synchronous hangup during resource teardown, potentially leading to instability in systems using affected Linux kernel versions.

Compliance Impact

This vulnerability in the Linux kernel could lead to use-after-free and NULL-pointer dereferences during tty port operations, potentially causing system instability or crashes. Such issues may impact compliance with standards like GDPR or HIPAA by compromising data integrity or availability, though specific regulatory effects depend on system configuration and use case.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. Reboot the system after applying patches to ensure the updated kernel is active. Monitor system logs for any recurring tty-related errors post-update.

Hi! I’m here to help you understand CVE-2026-98752. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70