CVE-2026-98752
Received
Received - Intake
Race Condition in Linux Kernel TTY Port Handling
Vulnerability report for CVE-2026-98752, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
tty: port: fix tty_port_tty_vhangup() race
Drivers rely on tty_port_tty_vhangup() to synchronously hang up their
ports before tearing down resources as part of deregistration (e.g. on
physical disconnect).
If tty_port_tty_vhangup() races with another hangup it may however
return before the port has been shut down. This is in turn can lead to
use-after-free and NULL-pointer dereferences in racing ioctls (including
a synchronous hangup) and in processing of racing asynchronous hangups
(carrier loss).
Add the missing serialisation to tty_port_tty_vhangup() and
tty_port_hangup() so that the former does not return until the port has
been shut down also when there is a racing hangup.
Note that serial core does not use tty_port_hangup(), but it already
holds the port mutex when clearing port->tty and shutting down the port
in uart_hangup().
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e |
| Linux | Linux | 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e |
| Linux | Linux | 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e |
| Linux | Linux | 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e |
| Linux | Linux | 4260dc792fabfd20c8644fa9414b2ae48372365f |
| Linux | Linux | 2.6.31.2 |
| Linux | Linux | 2.6.32 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
