Cloudanix VulnDB

CVE-2026-98695

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux USB connections could allow a quick plug-unplug action to crash the whole system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between tty ioctls and hangup in USB serial driver allows NULL pointer dereference when a device is disconnected during break signaling or port access.

Why it matters to the business

Linux systems using USB serial devices face risk of kernel crashes and denial of service; low exploitability but requires prompt kernel patching to avoid operational disruption on affected hardware.

How an attack unfolds

An attacker with physical or local access connects a USB serial device, triggers lengthy break signaling via ioctl, then rapidly disconnects the device to win the race against hangup, resulting in NULL dereference when port driver data is accessed.

How to fix it

Update the Linux kernel to a version containing the fix that serializes tty ioctl callbacks with the port mutex and adds hangup checks before accessing driver data.

How to confirm the fix worked

Verify the presence of the mutex serialization and port-hung-up checks in the USB serial tty layer source; test by simulating rapid connect/disconnect during break ioctls and confirm no NULL dereference occurs.

Typical attack path

  1. Attach USB serial device to target system
  2. Issue TIOCSBRK or similar ioctl to start break signaling
  3. Disconnect device while ioctl callback is active
  4. Trigger NULL pointer dereference in tty port handling

How to detect it

Review kernel logs for NULL pointer dereference or oops messages involving tty_port, usb_serial, or break signaling; correlate with sudden USB device removal events around the crash time.

  • usb_serial: tty_port NULL dereference
  • TIOCSBRK hangup race
  • serial: fix ioctl hangup

What your security team should do

  • Apply the kernel update containing the USB serial race fix as soon as available
  • Restrict physical USB access on systems where feasible
  • Monitor kernel logs for tty and usb serial oops entries
  • Prioritize patching on systems with frequent USB serial device usage

The record

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware. This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling. Note that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or hardware and are therefore not affected by the race.

Affected packages

Ecosystem Package Introduced Fixed