CVE-2026-74675

vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

State: Published
Severity: 7.8 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b84fd400f80adf4d1c88fbce50ae1cf2f8119e65Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38400673c9bfb39cfc87539e1a072087e98f4e4fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cab5a342f0589334046741006d8a280514f94235Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38a0aa593ebc275aea6f79534d07f44e43768ce6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3f6b1d3fcfc26dc3fc85262f753439df93b055b4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b664592e9ba8c47c9e23408db7ba52eb9f946c8aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cc4a1a2ce0c58eafd477effb055863935260ddc1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e25d47a526939ad44b75f778b8a7500562b84fc1Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b84fd400f80adf4d1c88fbce50ae1cf2f8119e65Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38400673c9bfb39cfc87539e1a072087e98f4e4fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cab5a342f0589334046741006d8a280514f94235Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38a0aa593ebc275aea6f79534d07f44e43768ce6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3f6b1d3fcfc26dc3fc85262f753439df93b055b4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b664592e9ba8c47c9e23408db7ba52eb9f946c8aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cc4a1a2ce0c58eafd477effb055863935260ddc1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e25d47a526939ad44b75f778b8a7500562b84fc1Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.