CVE-2026-98695

USB: serial: fix ioctl hangup race

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: fix ioctl hangup race

The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down.

Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware.

This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling.

Note that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or hardware and are therefore not affected by the race.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f34d7a5b7010b82fe97da95496b9971435530062 to before c7ef25e96dc3f808eb891bbbd43b6a682846eb0cAffected f34d7a5b7010b82fe97da95496b9971435530062 to before 98f0a25134bfce44ebd1db0341fa0e8603ff276dAffected f34d7a5b7010b82fe97da95496b9971435530062 to before 3a728adbed9fd822f99a9d9c5ebad5c3b565ba4aAffected f34d7a5b7010b82fe97da95496b9971435530062 to before 24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0fAffected f34d7a5b7010b82fe97da95496b9971435530062 to before ae0da9a5c1ca95c20cc5feffd511ce6eae75924eAffected f34d7a5b7010b82fe97da95496b9971435530062 to before 4597ddd6168ae2a4123404e5f0871f1070dc7773Affected f34d7a5b7010b82fe97da95496b9971435530062 to before 7912a95d1345c77d8d63b530b00c118700b78abdAffected f34d7a5b7010b82fe97da95496b9971435530062 to before ae0e61d95677efa778379853e495d748e6efbf95Affected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f34d7a5b7010b82fe97da95496b9971435530062 to before c7ef25e96dc3f808eb891bbbd43b6a682846eb0cAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before 98f0a25134bfce44ebd1db0341fa0e8603ff276dAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before 3a728adbed9fd822f99a9d9c5ebad5c3b565ba4aAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before 24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0fAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before ae0da9a5c1ca95c20cc5feffd511ce6eae75924eAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before 4597ddd6168ae2a4123404e5f0871f1070dc7773Affected
f34d7a5b7010b82fe97da95496b9971435530062 to before 7912a95d1345c77d8d63b530b00c118700b78abdAffected
f34d7a5b7010b82fe97da95496b9971435530062 to before ae0e61d95677efa778379853e495d748e6efbf95Affected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.