CVE-2026-98753 tty: tty_port: restore TTY_IO_ERROR on activation failure
A race condition in the Linux kernel TTY subsystem can cause a kernel panic via NULL pointer dereference when accessing powered-down ports.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98753?
CVE-2026-98753 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tty: tty_port: restore TTY_IO_ERROR on activation failure
Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down.
This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open.
Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race.
Which versions are affected by CVE-2026-98753?
How do I fix CVE-2026-98753?
Apply the vendor's patch.
Is CVE-2026-98753 being exploited?
There is no known exploitation of CVE-2026-98753 in the wild and no public exploit code.
Sources
Also known as AZL-109020, BELL-CVE-2026-98753, DEBIAN-CVE-2026-98753, GHSA-fxvh-5c26-7p3q, UBUNTU-CVE-2026-98753.