Live › vulnerability › CVE-2026-98750
Go to dashboardA race between closing a TTY and re-registering a device that reuses its minor number can cause a use-after-free in the Linux kernel. The sources describe the flaw but do not state what an attacker gains beyond memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with TTY drivers that reuse minor numbers on device registration are the ones the description points at. The sources do not say which drivers or configurations trigger the race, so unknown whether a given server is exposed.
No product ranges from the sources yet.
uname -r to see the running kernel versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tty: fix saved termios reset race
Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set).
Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration.
Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.
This page as .md · .json · in your agent: get_signal("CVE-2026-98750")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.