---
id: CVE-2026-98839
title: >-
  vt: selection: Fix unsigned underflow and slab-out-of-bounds read in
  paste_selection()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  vt: selection: Fix unsigned underflow and slab-out-of-bounds read in
  paste_selection()


  In paste_selection(), the loop copies min_t(unsigned int,

  vc_sel.buf_len - paste…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 <
    037d7e3ca5c593092f4b0d471eb869a85cbddde0
  - >-
    Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 <
    619c6d7dd76fff15a9714fbf02ce299b737f01a2
  - >-
    Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 <
    39495ef5d6f8019e62d65807f217a7ca8232727a
  - Linux 54c522782fd11a720f959ee9cb5a15bb9580343d
  - Linux 05c508edc9d0b44e4706d3c2cf14ee12aac210d2
  - Linux e5be0e24ffc7f5783a3864b5b958088ed15be9e8
  - Linux a4719f6d07b2c63223f7452c435c5f578f105cfe
  - Linux b4492f1e7456bd162714c0ec2815c2749d930844
  - Linux 9a9c13ad21a8220cb70c9807a920f43520515f94
  - Linux 8c368d36878e2fc99285279fc5e14b3d3cb8947c
  - Linux >= 3.16.83 < 3.17
  - Linux >= 4.4.216 < 4.5
  - Linux >= 4.9.216 < 4.10
  - Linux >= 4.14.173 < 4.15
  - Linux >= 4.19.109 < 4.20
  - Linux >= 5.4.25 < 5.5
  - Linux >= 5.5.9 < 5.6
  - Linux 5.6
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:50:11.869Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98839'
references:
  - url: 'https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0'
  - url: 'https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2'
  - url: 'https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.467Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

In paste_selection(), the loop copies min_t(unsigned int,
vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into
tty_ldisc_receive_buf() and increments pasted += count.

Because the selection mutex (vc_sel.lock) is dropped inside the loop
Whenever the line discipline buffer fills up and paste_selection()
sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
can replace vc_sel.buffer with a shorter selection and reduce
vc_sel.buf_len below pasted.

When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an
unsigned integer to a large positive value, causing
tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.

Fix this by terminating the loop when pasted >= vc_sel.buf_len.

Kernel stack trace (Linux 7.3.0-rc3):
 ==================================================================
 BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650
 Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65
 Workqueue: events_unbound flush_to_ldisc
 Call Trace:
  <TASK>
  dump_stack_lvl+0x70/0xa0
  print_report+0x153/0x4c6
  kasan_report+0xf1/0x120
  kasan_check_range+0x11c/0x200
  __asan_memcpy+0x29/0x70
  n_tty_receive_buf_common+0xa01/0x1650
  tty_ldisc_receive_buf+0x66/0x110
  tty_port_default_receive_buf+0x6b/0xb0
  flush_to_ldisc+0x1b4/0x410
  process_one_work+0x6ff/0x1110
  worker_thread+0x4a8/0xb70
  kthread+0x307/0x3e0
  ret_from_fork+0x3ed/0x680
  </TASK>
 ==================================================================

## Affected

- `Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 < 037d7e3ca5c593092f4b0d471eb869a85cbddde0`
- `Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 < 619c6d7dd76fff15a9714fbf02ce299b737f01a2`
- `Linux >= e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 < 39495ef5d6f8019e62d65807f217a7ca8232727a`
- `Linux 54c522782fd11a720f959ee9cb5a15bb9580343d`
- `Linux 05c508edc9d0b44e4706d3c2cf14ee12aac210d2`
- `Linux e5be0e24ffc7f5783a3864b5b958088ed15be9e8`
- `Linux a4719f6d07b2c63223f7452c435c5f578f105cfe`
- `Linux b4492f1e7456bd162714c0ec2815c2749d930844`
- `Linux 9a9c13ad21a8220cb70c9807a920f43520515f94`
- `Linux 8c368d36878e2fc99285279fc5e14b3d3cb8947c`
- `Linux >= 3.16.83 < 3.17`
- `Linux >= 4.4.216 < 4.5`
- `Linux >= 4.9.216 < 4.10`
- `Linux >= 4.14.173 < 4.15`
- `Linux >= 4.19.109 < 4.20`
- `Linux >= 5.4.25 < 5.5`
- `Linux >= 5.5.9 < 5.6`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.