CVE-2026-98839
Received Received - Intake

Buffer Overflow in Linux Kernel vt Selection

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count. Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted. When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer. Fix this by terminating the loop when pasted >= vc_sel.buf_len. Kernel stack trace (Linux 7.3.0-rc3): ================================================================== BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650 Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65 Workqueue: events_unbound flush_to_ldisc Call Trace: <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200 __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ==================================================================

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98839
EUVD
EUVD-2026-103779

Affected Vendors & Products

Showing 18 associated CPEs
Vendor Product Version / Range
Linux Linux e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2
Linux Linux e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2
Linux Linux e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2
Linux Linux 54c522782fd11a720f959ee9cb5a15bb9580343d
Linux Linux 05c508edc9d0b44e4706d3c2cf14ee12aac210d2
Linux Linux e5be0e24ffc7f5783a3864b5b958088ed15be9e8
Linux Linux a4719f6d07b2c63223f7452c435c5f578f105cfe
Linux Linux b4492f1e7456bd162714c0ec2815c2749d930844
Linux Linux 9a9c13ad21a8220cb70c9807a920f43520515f94
Linux Linux 8c368d36878e2fc99285279fc5e14b3d3cb8947c
Linux Linux 3.16.83
Linux Linux 4.4.216
Linux Linux 4.9.216
Linux Linux 4.14.173
Linux Linux 4.19.109
Linux Linux 5.4.25
Linux Linux 5.5.9
Linux Linux 5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition in the virtual terminal (vt) selection handling can lead to an unsigned integer underflow and a slab-out-of-bounds read. The issue occurs in the paste_selection() function when a concurrent TIOCLINUX ioctl modifies the selection buffer size while the function is copying data, causing it to read beyond the allocated buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtual terminal (vt) selection handling. Detection requires checking for slab-out-of-bounds read errors in kernel logs or KASAN reports. Monitor system logs for KASAN errors or kernel oops messages indicating out-of-bounds memory access in tty-related functions.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable information disclosure by reading sensitive kernel memory.

Mitigation Strategies

Apply the kernel patch that fixes the unsigned underflow in paste_selection(). Update to a Linux kernel version that includes the fix for CVE-2026-98839. If patching is not immediately possible, restrict access to TIOCLINUX ioctl operations to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart