{"id":"CVE-2026-98754","title":"tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: hold port lock when clearing tty pointer in vcc_cleanup\n\nvcc_cleanup() sets port->tty to NULL without holding port->lock, racing\nwith vcc_event() LDC callback…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 88f6ecb058801e9ce7b9aabc966530118d7cd53c","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 821050631750e982007c0856c119346edba51cae","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 03b49c991abb8d021ca6fe51cd173447236b0552","Linux < 6.12.113","Linux < 6.18.56","Linux < 7.2.10","Linux (all versions)"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:47:40.255Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98754","references":[{"url":"https://git.kernel.org/stable/c/88f6ecb058801e9ce7b9aabc966530118d7cd53c"},{"url":"https://git.kernel.org/stable/c/821050631750e982007c0856c119346edba51cae"},{"url":"https://git.kernel.org/stable/c/1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4"},{"url":"https://git.kernel.org/stable/c/03b49c991abb8d021ca6fe51cd173447236b0552"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.499Z","slug":"CVE-2026-98754","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: hold port lock when clearing tty pointer in vcc_cleanup\n\nvcc_cleanup() sets port->tty to NULL without holding port->lock, racing\nwith vcc_event() LDC callbacks that read port->tty under port->lock and\nthen use tty->port. This can cause a use-after-free when the callback\ndereferences tty->port after cleanup has already destroyed and freed it.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 88f6ecb058801e9ce7b9aabc966530118d7cd53c`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 821050631750e982007c0856c119346edba51cae`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 03b49c991abb8d021ca6fe51cd173447236b0552`\n- `Linux < 6.12.113`\n- `Linux < 6.18.56`\n- `Linux < 7.2.10`\n- `Linux (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}