Cloudanix VulnDB

CVE-2026-98754

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing mistake in the Linux kernel's terminal handling code can let a program on the same machine corrupt memory or crash the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition allowing use-after-free: vcc_cleanup clears port->tty without the port lock while concurrent vcc_event LDC callbacks read the pointer under the lock and later dereference tty->port after the tty structure is freed.

Why it matters to the business

Potential kernel crash, memory corruption, or local privilege escalation on systems running the affected kernel code; high urgency for organizations with many Linux servers or embedded devices due to the bug's presence in the mainline kernel.

How an attack unfolds

An attacker with local access triggers concurrent tty cleanup and LDC event callbacks to win the race, dereferencing a freed tty structure to achieve use-after-free for denial of service or memory corruption leading to code execution.

How to fix it

Update to a Linux kernel version containing the fix that holds the port lock during tty pointer clearing in vcc_cleanup; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Verify the presence of the lock acquisition around the port->tty = NULL assignment in vcc_cleanup source; test by running concurrent tty open/close and LDC event workloads under lockdep or KASAN to confirm absence of use-after-free reports.

Typical attack path

  1. Obtain local unprivileged access on a Linux system
  2. Open and manipulate a vcc/tty device while triggering LDC callbacks
  3. Force vcc_cleanup to run concurrently with vcc_event
  4. Win the race to use the dangling tty->port pointer after free
  5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for use-after-free warnings or KASAN reports involving tty or vcc structures; inspect for unusual crashes during tty device operations or LDC callback handling.

What your security team should do

  • Prioritize kernel updates on all exposed Linux hosts within the next patch cycle
  • Enable kernel hardening features such as KASAN and lockdep in test environments
  • Monitor for upstream stable kernel releases containing this fix
  • Restrict unprivileged local access where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

Affected packages

Ecosystem Package Introduced Fixed