All vulnerabilities
CVE-2026-98751

Linux: tty: abort break signalling on hangup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6c9c9367351a461d62e5c0a39bffdcfbb40f068bAlso 3bc82999fb85cecc7eb6ec1755ee7d698aa1e783, 94af6cd832e9b4ce39a8fb59144a8f09ab56fd35 and 1 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6c9c9367351a461d62e5c0a39bffdcfbb40f068bLinuxCVE List
  • 3bc82999fb85cecc7eb6ec1755ee7d698aa1e783LinuxCVE List
  • 94af6cd832e9b4ce39a8fb59144a8f09ab56fd35LinuxCVE List
  • 845a2737e0f5ffe5ca8d38de556012b0c9472cddLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: abort break signalling on hangup

The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down.

Drivers must handle this race, but TCSBRK and TCSBRKP should still be aborted to avoid calling back into the driver after a user-controlled timeout (possibly even after the tty has been reopened).

Note that drivers should disable any break state on shutdown so just return on hangup (calling break_ctl() again is racy and will most likely fail for drivers handling the race).

Text from CVE List

Affected versions 12

  • Linuxaffected: f34d7a5b7010b82fe97da95496b9971435530062 before 6c9c9367351a461d62e5c0a39bffdcfbb40f068bCVE List
  • Linuxaffected: f34d7a5b7010b82fe97da95496b9971435530062 before 3bc82999fb85cecc7eb6ec1755ee7d698aa1e783CVE List
  • Linuxaffected: f34d7a5b7010b82fe97da95496b9971435530062 before 94af6cd832e9b4ce39a8fb59144a8f09ab56fd35CVE List
  • Linuxaffected: f34d7a5b7010b82fe97da95496b9971435530062 before c8ccd3b2013daaf77b98f8a6724fcf4d2c5c52d6CVE List
  • Linuxaffected: f34d7a5b7010b82fe97da95496b9971435530062 before 845a2737e0f5ffe5ca8d38de556012b0c9472cddCVE List
  • Linuxaffected: 2.6.26CVE List
  • Linuxunaffected: all versions before 2.6.26CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5