{"id":"CVE-2026-98754","summary":"tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: hold port lock when clearing tty pointer in vcc_cleanup\n\nvcc_cleanup() sets port-\u003etty to NULL without holding port-\u003elock, racing\nwith vcc_event() LDC callbacks that read port-\u003etty under port-\u003elock and\nthen use tty-\u003eport. This can cause a use-after-free when the callback\ndereferences tty-\u003eport after cleanup has already destroyed and freed it.","modified":"2026-11-04T14:27:17.271627600Z","published":"2026-10-18T15:47:40.255Z","related":["SUSE-SU-2026:5091-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98754.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/03b49c991abb8d021ca6fe51cd173447236b0552"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/57753441ef84bee3bf0e9ee1e3778d119c44aa32"},{"type":"WEB","url":"https://git.kernel.org/stable/c/821050631750e982007c0856c119346edba51cae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88f6ecb058801e9ce7b9aabc966530118d7cd53c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/afcbb821c571f39b273127a7c7d26cb2cef27d2f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b0ad9d025c3229a628a82fbaa7578891075a950d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b193617080b7036d143674089bcfb7d2ba3db588"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98754.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98754"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb"},{"fixed":"b0ad9d025c3229a628a82fbaa7578891075a950d"},{"fixed":"b193617080b7036d143674089bcfb7d2ba3db588"},{"fixed":"afcbb821c571f39b273127a7c7d26cb2cef27d2f"},{"fixed":"57753441ef84bee3bf0e9ee1e3778d119c44aa32"},{"fixed":"88f6ecb058801e9ce7b9aabc966530118d7cd53c"},{"fixed":"821050631750e982007c0856c119346edba51cae"},{"fixed":"1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4"},{"fixed":"03b49c991abb8d021ca6fe51cd173447236b0552"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98754.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98754.json"}}],"schema_version":"1.9.2"}