CVE-2026-74675
Received Received - Intake

Linux Kernel VT tty Reference Race Condition

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74675
EUVD
EUVD-2026-64362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the vt subsystem. The function kbd_keycode() accesses a tty device without holding a proper reference, which can lead to a use-after-free scenario if the tty device is shut down concurrently by con_shutdown(). The fix uses tty_port_tty_get() and tty_kref_put() to safely manage the tty reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's vt subsystem and does not have a direct network detection method. It can be detected by checking the kernel version and verifying if the fix is applied. Use commands like 'uname -r' to check the kernel version and compare it against patched versions.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited. It may lead to unexpected behavior in terminal input handling, potentially allowing unauthorized access or privilege escalation if an attacker triggers the race condition.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-74675. This typically involves running system updates via your package manager (e.g., 'apt update && apt upgrade' or 'yum update').

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart