Live › vulnerability › CVE-2026-98695
Go to dashboardA race between tty ioctls and device hangup in the Linux kernel USB serial driver lets an ioctl call into a driver for a device that is already disconnected. The sources describe this as a NULL-pointer dereference when a device is removed during lengthy break signalling.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: fix ioctl hangup race
The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down.
Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware.
This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling.
Note that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or hardware and are therefore not affected by the race.
This page as .md · .json · in your agent: get_signal("CVE-2026-98695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.