{"id":"CVE-2026-98752","aliases":[],"cve":{"records":[{"id":"CVE-2026-98752","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.368Z","published":"2026-10-18T15:47:36.877Z","modified":"2026-10-30T12:39:22.635Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:39:22.635Z"}],"references":[{"url":"https://git.kernel.org/stable/c/a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/2e16ae1464a4f435425c6f6ff1e293db850a624c","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a776d603d1e1bba2837295817b0a39394707b10d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/ce220b4cdf62f73db0c1940f968eb33b9899fdd0","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/6d1a984afc3ca477dab3e51ec806671d443ad524","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/6b7be3b9b857947e9c1338d4919d4ebd3b75e907","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/017b18addbe8dcace1a569a00d40ed1ba1e03f4c","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b48820de8c1a596c5b99775524dfce73c6576c5d","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31.2"}]}]}]}],"prioritization":[]},"title":"tty: port: fix tty_port_tty_vhangup() race","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: port: fix tty_port_tty_vhangup() race\n\nDrivers rely on tty_port_tty_vhangup() to synchronously hang up their\nports before tearing down resources as part of deregistration (e.g. on\nphysical disconnect).\n\nIf tty_port_tty_vhangup() races with another hangup it may however\nreturn before the port has been shut down. This is in turn can lead to\nuse-after-free and NULL-pointer dereferences in racing ioctls (including\na synchronous hangup) and in processing of racing asynchronous hangups\n(carrier loss).\n\nAdd the missing serialisation to tty_port_tty_vhangup() and\ntty_port_hangup() so that the former does not return until the port has\nbeen shut down also when there is a racing hangup.\n\nNote that serial core does not use tty_port_hangup(), but it already\nholds the port mutex when clearing port->tty and shutting down the port\nin uart_hangup().","score":null,"severity":"unknown","published":"2026-10-18T15:47:36.877Z","modified":"2026-10-30T12:39:22.635Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"2e16ae1464a4f435425c6f6ff1e293db850a624c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a776d603d1e1bba2837295817b0a39394707b10d","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"ce220b4cdf62f73db0c1940f968eb33b9899fdd0","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6d1a984afc3ca477dab3e51ec806671d443ad524","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6b7be3b9b857947e9c1338d4919d4ebd3b75e907","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"017b18addbe8dcace1a569a00d40ed1ba1e03f4c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"b48820de8c1a596c5b99775524dfce73c6576c5d","versionType":"git"},{"version":"4260dc792fabfd20c8644fa9414b2ae48372365f","status":"affected","versionType":"git"},{"version":"2.6.31.2","status":"affected","lessThan":"2.6.32","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98752"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"2.6.32","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.32","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98752"}],"remediation":[],"references":["https://git.kernel.org/stable/c/a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","https://git.kernel.org/stable/c/2e16ae1464a4f435425c6f6ff1e293db850a624c","https://git.kernel.org/stable/c/a776d603d1e1bba2837295817b0a39394707b10d","https://git.kernel.org/stable/c/ce220b4cdf62f73db0c1940f968eb33b9899fdd0","https://git.kernel.org/stable/c/6d1a984afc3ca477dab3e51ec806671d443ad524","https://git.kernel.org/stable/c/6b7be3b9b857947e9c1338d4919d4ebd3b75e907","https://git.kernel.org/stable/c/017b18addbe8dcace1a569a00d40ed1ba1e03f4c","https://git.kernel.org/stable/c/b48820de8c1a596c5b99775524dfce73c6576c5d"],"sources":[{"name":"CVE","id":"CVE-2026-98752","modified":"2026-10-30T12:39:22.635Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98752"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T14:04:54.392Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}