CVE-2026-98754 PUBLISHED

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 88f6ecb058801e9ce7b9aabc966530118d7cd53c (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 821050631750e982007c0856c119346edba51cae (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 03b49c991abb8d021ca6fe51cd173447236b0552 (excl.)
  • affected from 0 to 6.12.113 (excl.)
  • affected from 0 to 6.18.56 (excl.)
  • affected from 0 to 7.2.10 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • unaffected from 6.12.113 to 6.12.* (incl.)
  • unaffected from 6.18.56 to 6.18.* (incl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References