Cloudanix VulnDB

CVE-2026-98839

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles copying text between terminal windows could let a local user accidentally read or crash parts of the system's memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unsigned integer underflow in paste_selection() allows slab-out-of-bounds read when concurrent TIOCL_SETSEL ioctl shortens vc_sel.buf_len while the selection mutex is dropped, causing tty_ldisc_receive_buf to read up to 4094 bytes past the new buffer.

Why it matters to the business

Linux systems may experience kernel crashes, memory disclosure, or denial of service affecting servers, containers, and embedded devices with no widespread exploitation observed yet.

How an attack unfolds

A local attacker opens a virtual terminal, initiates paste_selection, and races a TIOCLINUX ioctl to shrink the selection buffer while the loop sleeps, triggering the underflow and out-of-bounds read on resume.

How to fix it

Apply the upstream fix that adds an explicit check to terminate the paste loop when pasted >= vc_sel.buf_len; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Verify the presence of the loop-termination condition in paste_selection() source or confirm kernel builds contain the referenced commit; test by exercising concurrent selection operations under KASAN.

Typical attack path

  1. Obtain local unprivileged access to a Linux system
  2. Trigger paste_selection via terminal selection paste
  3. Issue concurrent TIOCL_SETSEL ioctl to reduce buf_len
  4. Cause underflow and OOB read into slab memory

How to detect it

Search kernel logs and crash dumps for KASAN slab-out-of-bounds reports citing n_tty_receive_buf_common or flush_to_ldisc during paste_selection activity; correlate with TIOCL_SETSEL ioctl usage in audit logs.

  • BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common
  • paste_selection
  • tty_ldisc_receive_buf
  • vc_sel.buf_len - pasted

What your security team should do

  • Prioritize kernel updates on multi-user and container hosts
  • Monitor for KASAN or slab OOB crash reports involving n_tty_receive_buf_common
  • Restrict local TIOCLINUX ioctl access via SELinux or AppArmor where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count. Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted. When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer. Fix this by terminating the loop when pasted >= vc_sel.buf_len. Kernel stack trace (Linux 7.3.0-rc3): ================================================================== BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650 Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65 Workqueue: events_unbound flush_to_ldisc Call Trace: <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200 __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ==================================================================

Affected packages

Ecosystem Package Introduced Fixed