CVE-2026-98754

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before b0ad9d025c3229a628a82fbaa7578891075a950dAffected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before b193617080b7036d143674089bcfb7d2ba3db588Affected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before afcbb821c571f39b273127a7c7d26cb2cef27d2fAffected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 57753441ef84bee3bf0e9ee1e3778d119c44aa32Affected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 88f6ecb058801e9ce7b9aabc966530118d7cd53cAffected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 821050631750e982007c0856c119346edba51caeAffected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4Affected 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 03b49c991abb8d021ca6fe51cd173447236b0552Affected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before b0ad9d025c3229a628a82fbaa7578891075a950dAffected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before b193617080b7036d143674089bcfb7d2ba3db588Affected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before afcbb821c571f39b273127a7c7d26cb2cef27d2fAffected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 57753441ef84bee3bf0e9ee1e3778d119c44aa32Affected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 88f6ecb058801e9ce7b9aabc966530118d7cd53cAffected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 821050631750e982007c0856c119346edba51caeAffected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4Affected
8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb to before 03b49c991abb8d021ca6fe51cd173447236b0552Affected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.