CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race
A race condition in the Linux kernel tty port hangup logic can lead to use-after-free and NULL pointer dereferences, potentially allowing local attackers to execute code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98752?
CVE-2026-98752 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tty: port: fix tty_port_tty_vhangup() race
Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect).
If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss).
Add the missing serialisation to tty_port_tty_vhangup() and tty_port_hangup() so that the former does not return until the port has been shut down also when there is a racing hangup.
Note that serial core does not use tty_port_hangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uart_hangup().
Which versions are affected by CVE-2026-98752?
How do I fix CVE-2026-98752?
Apply the vendor's patch.
Is CVE-2026-98752 being exploited?
There is no known exploitation of CVE-2026-98752 in the wild and no public exploit code.
Sources
Also known as AZL-109184, BELL-CVE-2026-98752, DEBIAN-CVE-2026-98752, GHSA-2697-8gj7-2gh6, UBUNTU-CVE-2026-98752.