CVE-2026-98695 USB: serial: fix ioctl hangup race
A race condition in the Linux kernel USB serial driver allows local attackers to cause a denial of service via NULL pointer dereference during device disconnection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98695?
CVE-2026-98695 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix ioctl hangup race
The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down.
Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware.
This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling.
Note that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or hardware and are therefore not affected by the race.
Which versions are affected by CVE-2026-98695?
How do I fix CVE-2026-98695?
Apply the vendor's patch.
Is CVE-2026-98695 being exploited?
There is no known exploitation of CVE-2026-98695 in the wild and no public exploit code.
Sources
Also known as AZL-109016, BELL-CVE-2026-98695, DEBIAN-CVE-2026-98695, GHSA-w8fg-4vmm-x6q5, UBUNTU-CVE-2026-98695.