CVE-2026-98751 tty: abort break signalling on hangup
A race condition in Linux kernel TTY break signaling allows local attackers to trigger a denial of service by racing hangup with break ioctls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98751?
CVE-2026-98751 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tty: abort break signalling on hangup
The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down.
Drivers must handle this race, but TCSBRK and TCSBRKP should still be aborted to avoid calling back into the driver after a user-controlled timeout (possibly even after the tty has been reopened).
Note that drivers should disable any break state on shutdown so just return on hangup (calling break_ctl() again is racy and will most likely fail for drivers handling the race).
Which versions are affected by CVE-2026-98751?
How do I fix CVE-2026-98751?
Apply the vendor's patch.
Is CVE-2026-98751 being exploited?
There is no known exploitation of CVE-2026-98751 in the wild and no public exploit code.
Sources
Also known as AZL-108975, BELL-CVE-2026-98751, DEBIAN-CVE-2026-98751, GHSA-cg92-2wfv-ppg3, UBUNTU-CVE-2026-98751.