{"id":"CVE-2026-98751","kind":"vulnerability","aliases":["CVE-2026-98751"],"related":[],"title":"Linux kernel: tty break ioctl race with hangup can call a dead driver","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: abort break signalling on hangup\n\nThe break ioctls can race with hangup and end up calling into a tty\ndriver for a device that is already gone or powered down.\n\nDrivers must handle this race, but TCSBRK and TCSBRKP should still be\naborted to avoid calling back into the driver after a user-controlled\ntimeout (possibly even after the tty has been reopened).\n\nNote that drivers should disable any break state on shutdown so just\nreturn on hangup (calling break_ctl() again is racy and will most likely\nfail for drivers handling the race).","summary":"The Linux kernel's tty break ioctls (TCSBRK and TCSBRKP) can race with a terminal hangup and call into a tty driver for a device that is already gone or powered down. The fix aborts break signalling on hangup so the driver is not called back after a user-controlled timeout, possibly after the tty has been reopened.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","tty"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:53+00:00","updated_at":"2026-10-25T05:16:53+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:16:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tty break ioctl race with hangup can call a dead driver","impact":"low","summary":"The Linux kernel's tty break ioctls (TCSBRK and TCSBRKP) can race with a terminal hangup and call into a tty driver for a device that is already gone or powered down. The fix aborts break signalling on hangup so the driver is not called back after a user-controlled timeout, possibly after the tty has been reopened.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","tty"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Sources give only the kernel commit text; check the NVD record or the upstream stable commit for affected kernel version ranges, the crash or memory impact, and the fixed kernel versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00053,"input_tokens":3410,"output_tokens":378,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98751':16A,19A 'abort':58B,94C,136C 'alreadi':51B,119C 'avoid':138C 'back':69B,140C 'break':4A,29B,59B,95C,100C,164C,174C 'call':10A,41B,68B,109C,139C,173C 'control':74B,148C 'ctl':175C 'cve':14A,17A 'dead':12A 'devic':48B,116C 'disabl':162C 'driver':13A,45B,65B,113C,124C,143C,160C,185C 'end':107C 'even':151C 'fail':183C 'fix':57B 'follow':88C 'gone':52B,120C 'handl':126C,186C 'hangup':8A,39B,62B,98C,105C,172C 'ioctl':5A,30B,101C 'kernel':2A,20B,26B,86C 'like':182C 'linux':1A,21B,25B,85C 'must':125C 'note':158C 'possibl':76B,150C 'power':54B,122C 'race':6A,35B,103C,128C,188C 'raci':178C 'reopen':82B,157C 'resolv':92C 'return':170C 'runtim':22B 'shutdown':167C 'signal':60B,96C 'state':165C 'still':134C 'tcsbrk':31B,130C 'tcsbrkp':33B,132C 'termin':38B 'timeout':75B,149C 'tti':3A,23B,28B,44B,79B,93C,112C,154C 'user':73B,147C 'user-control':72B,146C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98751","severity":null,"published_at":"2026-10-18T16:17:28+00:00","modified_at":"2026-10-21T13:21:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}