Cloudanix VulnDB

CVE-2026-98750

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles device settings during rapid reuse of the same device number can let local users crash the system or potentially gain higher privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between TTY close (saving termios state) and device re-registration when minor numbers are reused allows use-after-free on termios data structures.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes, denial of service, or potential privilege escalation, impacting system stability and requiring urgent patching of kernel packages.

How an attack unfolds

An attacker with local access opens a TTY device, triggers concurrent re-registration of a driver reusing the minor number, and closes the TTY to race the termios save operation against the new registration, resulting in use-after-free.

How to fix it

Update the Linux kernel to a version containing the TTY_DRIVER_RESET_SAVED_TERMIOS flag and ensure affected TTY drivers set the flag during registration; apply vendor-supplied kernel updates as soon as available.

How to confirm the fix worked

Confirm the kernel source includes the new flag definition and that vulnerable drivers invoke it on registration; verify no termios reuse occurs across minor number reassignments via code review or targeted fuzzing.

Typical attack path

  1. Obtain local unprivileged access to a Linux system
  2. Identify and open a TTY device controlled by a vulnerable driver
  3. Trigger device re-registration that reuses the same minor number
  4. Close the TTY concurrently to race termios state saving
  5. Exploit resulting use-after-free for memory corruption or crash

How to detect it

Inspect kernel logs for use-after-free warnings or oops involving tty or termios structures; correlate with device registration events and TTY close operations in system audit logs.

What your security team should do

  • Prioritize kernel updates on all Linux systems within the next patching cycle due to local privilege escalation potential
  • Monitor for new kernel releases addressing TTY registration races
  • Restrict unprivileged local access where possible until patches are applied
  • Review custom TTY drivers for proper minor number lifecycle handling

The record

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.

Affected packages

Ecosystem Package Introduced Fixed