{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98839 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98839 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98839 and fix it if it is affected.\n\nWhat it is: CVE-2026-98839 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98839 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98839/ (Markdown: https://insights.sbomify.com/CVE-2026-98839/index.md)","id":"CVE-2026-98839","markdown":"https://insights.sbomify.com/CVE-2026-98839/index.md","name":"CVE-2026-98839","record":{"aliases":["AZL-108933","BELL-CVE-2026-98839","DEBIAN-CVE-2026-98839","GHSA-rgr5-hhj8-qq6p","UBUNTU-CVE-2026-98839"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger an integer underflow in the Linux kernel's virtual terminal selection code, leading to an out-of-bounds read and potential information disclosure or system crash.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty-\u003ereceive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty-\u003ewrite_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted \u003e= vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x70/0xa0\n  print_report+0x153/0x4c6\n  kasan_report+0xf1/0x120\n  kasan_check_range+0x11c/0x200\n  __asan_memcpy+0x29/0x70\n  n_tty_receive_buf_common+0xa01/0x1650\n  tty_ldisc_receive_buf+0x66/0x110\n  tty_port_default_receive_buf+0x6b/0xb0\n  flush_to_ldisc+0x1b4/0x410\n  process_one_work+0x6ff/0x1110\n  worker_thread+0x4a8/0xb70\n  kthread+0x307/0x3e0\n  ret_from_fork+0x3ed/0x680\n  \u003c/TASK\u003e\n ==================================================================","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()","id":"CVE-2026-98839","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF","id":"CVE-2026-98840"},"packages":[],"prev":{"headline":"vt: skip screen update for DEC alignment test on backgroup consoles","id":"CVE-2026-98838"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can trigger an integer underflow in the Linux kernel's virtual terminal selection code, leading to an out-of-bounds read and potential information disclosure or system crash.","url":"https://insights.sbomify.com/CVE-2026-98839/"}