---
id: CVE-2026-98754
title: 'tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

  vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
  with vcc_event() LDC callback…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    88f6ecb058801e9ce7b9aabc966530118d7cd53c
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    821050631750e982007c0856c119346edba51cae
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    03b49c991abb8d021ca6fe51cd173447236b0552
  - Linux < 6.12.113
  - Linux < 6.18.56
  - Linux < 7.2.10
  - Linux (all versions)
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:40.255Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98754'
references:
  - url: 'https://git.kernel.org/stable/c/88f6ecb058801e9ce7b9aabc966530118d7cd53c'
  - url: 'https://git.kernel.org/stable/c/821050631750e982007c0856c119346edba51cae'
  - url: 'https://git.kernel.org/stable/c/1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4'
  - url: 'https://git.kernel.org/stable/c/03b49c991abb8d021ca6fe51cd173447236b0552'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.499Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
with vcc_event() LDC callbacks that read port->tty under port->lock and
then use tty->port. This can cause a use-after-free when the callback
dereferences tty->port after cleanup has already destroyed and freed it.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 88f6ecb058801e9ce7b9aabc966530118d7cd53c`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 821050631750e982007c0856c119346edba51cae`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 03b49c991abb8d021ca6fe51cd173447236b0552`
- `Linux < 6.12.113`
- `Linux < 6.18.56`
- `Linux < 7.2.10`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.