---
id: CVE-2026-98752
title: 'tty: port: fix tty_port_tty_vhangup() race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tty: port: fix tty_port_tty_vhangup() race

  Drivers rely on tty_port_tty_vhangup() to synchronously hang up their
  ports before tearing down resources as part of deregis…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e <
    6d1a984afc3ca477dab3e51ec806671d443ad524
  - >-
    Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e <
    6b7be3b9b857947e9c1338d4919d4ebd3b75e907
  - >-
    Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e <
    017b18addbe8dcace1a569a00d40ed1ba1e03f4c
  - >-
    Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e <
    b48820de8c1a596c5b99775524dfce73c6576c5d
  - Linux 4260dc792fabfd20c8644fa9414b2ae48372365f
  - Linux >= 2.6.31.2 < 2.6.32
  - Linux 2.6.32
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:36.877Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98752'
references:
  - url: 'https://git.kernel.org/stable/c/6d1a984afc3ca477dab3e51ec806671d443ad524'
  - url: 'https://git.kernel.org/stable/c/6b7be3b9b857947e9c1338d4919d4ebd3b75e907'
  - url: 'https://git.kernel.org/stable/c/017b18addbe8dcace1a569a00d40ed1ba1e03f4c'
  - url: 'https://git.kernel.org/stable/c/b48820de8c1a596c5b99775524dfce73c6576c5d'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.498Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tty: port: fix tty_port_tty_vhangup() race

Drivers rely on tty_port_tty_vhangup() to synchronously hang up their
ports before tearing down resources as part of deregistration (e.g. on
physical disconnect).

If tty_port_tty_vhangup() races with another hangup it may however
return before the port has been shut down. This is in turn can lead to
use-after-free and NULL-pointer dereferences in racing ioctls (including
a synchronous hangup) and in processing of racing asynchronous hangups
(carrier loss).

Add the missing serialisation to tty_port_tty_vhangup() and
tty_port_hangup() so that the former does not return until the port has
been shut down also when there is a racing hangup.

Note that serial core does not use tty_port_hangup(), but it already
holds the port mutex when clearing port->tty and shutting down the port
in uart_hangup().

## Affected

- `Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e < 6d1a984afc3ca477dab3e51ec806671d443ad524`
- `Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e < 6b7be3b9b857947e9c1338d4919d4ebd3b75e907`
- `Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e < 017b18addbe8dcace1a569a00d40ed1ba1e03f4c`
- `Linux >= 7ca0ff9ab3218ec443a7a9ad247e4650373ed41e < b48820de8c1a596c5b99775524dfce73c6576c5d`
- `Linux 4260dc792fabfd20c8644fa9414b2ae48372365f`
- `Linux >= 2.6.31.2 < 2.6.32`
- `Linux 2.6.32`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.