CVE-2026-98753

Received Received - Intake

TTY Port Activation Failure Restores TTY_IO_ERROR Flag

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open. Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98753

EUVD

EUVD-2026-103838

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a9a37ec33a1b3e66b260ac1c29bff0aec8b89ae4
Linux	Linux	a9a37ec33a1b3e66b260ac1c29bff0aec8b89ae4
Linux	Linux	a9a37ec33a1b3e66b260ac1c29bff0aec8b89ae4
Linux	Linux	a9a37ec33a1b3e66b260ac1c29bff0aec8b89ae4
Linux	Linux	2.6.33

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a failure to restore the TTY_IO_ERROR flag when a TTY port activation fails. This can lead to kernel panic or NULL-pointer dereferences if the port is powered down or deregistered while an ioctl races with hangup and open operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's TTY subsystem and may not have direct network detection methods. Check kernel logs for TTY-related errors or crashes using dmesg | grep tty or journalctl -k | grep tty. Monitor for kernel panics or NULL-pointer dereferences related to TTY operations.

Impact Analysis

The vulnerability may cause system crashes (kernel panic) or memory access errors if a TTY port is accessed after it has been powered down or deregistered due to a race condition between ioctl and hangup operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to TTY port handling that could lead to kernel panic or NULL-pointer dereferences during race conditions. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. Reboot the system if necessary to ensure the patched kernel is active. Review and update any TTY-related drivers or configurations to ensure proper handling of activation failures.

Hi! I’m here to help you understand CVE-2026-98753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70