All vulnerabilities
CVE-2026-98754

Linux: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in57753441ef84bee3bf0e9ee1e3778d119c44aa32Also 88f6ecb058801e9ce7b9aabc966530118d7cd53c, 821050631750e982007c0856c119346edba51cae and 6 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 57753441ef84bee3bf0e9ee1e3778d119c44aa32LinuxCVE List
  • 88f6ecb058801e9ce7b9aabc966530118d7cd53cLinuxCVE List
  • 821050631750e982007c0856c119346edba51caeLinuxCVE List
  • 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4LinuxCVE List
  • 03b49c991abb8d021ca6fe51cd173447236b0552LinuxCVE List
  • 6.6.160LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

Text from CVE List

Affected versions 14

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 57753441ef84bee3bf0e9ee1e3778d119c44aa32CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 88f6ecb058801e9ce7b9aabc966530118d7cd53cCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 821050631750e982007c0856c119346edba51caeCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 03b49c991abb8d021ca6fe51cd173447236b0552CVE List
  • Linuxaffected: all versions before 6.6.160CVE List
  • Linuxaffected: all versions before 6.12.113CVE List
  • Linuxaffected: all versions before 6.18.56CVE List
  • Linuxaffected: all versions before 7.2.10CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5