CVE-2026-98754
Received Received - Intake

Race Condition in Linux Kernel tty Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98754
EUVD
EUVD-2026-103839

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 0
Linux Linux 0
Linux Linux 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the tty subsystem. The function vcc_cleanup() clears the tty pointer without holding the necessary port lock, which can lead to a use-after-free scenario. Specifically, vcc_event() callbacks may read the tty pointer under the port lock and then attempt to use the tty's port after vcc_cleanup() has already destroyed and freed it.

Impact Analysis

This vulnerability could lead to system instability or crashes due to use-after-free errors. Attackers might exploit it to execute arbitrary code, escalate privileges, or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Ensure the fix for tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup is installed on affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart