{"id":"CVE-2026-98753","kind":"vulnerability","aliases":["CVE-2026-98753"],"related":[],"title":"Linux kernel: tty port race lets ioctl reach a powered-down port","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: tty_port: restore TTY_IO_ERROR on activation failure\n\nMake sure to restore the TTY_IO_ERROR flag if activation fails to\nprevent I/O attempts on a port that is gone or powered down.\n\nThis specifically avoids issues like kernel panic due to unclocked\naccesses or NULL-pointer dereferences when accessing powered down or\nderegistered ports when a TTY ioctl races with hangup and open.\n\nNote that the flag is set again in tty_port_close() but not restoring it\non activation failure leaves a window where drivers fail to handle the\nioctl-hangup race.","summary":"A race between a TTY ioctl and a hangup or open can leave a TTY port in a state where I/O is attempted on a port that is gone or powered down. The sources describe the result as possible kernel panic or NULL-pointer dereference, and the fix restores the TTY_IO_ERROR flag when port activation fails.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed kernel release listed in the advisory, which the sources do not name\n- unknown","fix":"- Update the Linux kernel to a release that includes the tty_port fix for TTY_IO_ERROR on activation failure; the fixed version is unknown from the sources\n- unknown","status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:54+00:00","updated_at":"2026-10-25T05:16:54+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:16:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the tty_port fix for TTY_IO_ERROR on activation failure; the fixed version is unknown from the sources\n- unknown","reach":"local","title":"Linux kernel: tty port race lets ioctl reach a powered-down port","impact":"high","summary":"A race between a TTY ioctl and a hangup or open can leave a TTY port in a state where I/O is attempted on a port that is gone or powered down. The sources describe the result as possible kernel panic or NULL-pointer dereference, and the fix restores the TTY_IO_ERROR flag when port activation fails.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel panic or NULL-pointer dereference from a racing ioctl","analyst_note":"Find the affected kernel version ranges and the fixed stable release in the NVD entry or the kernel stable mailing list commit for this tty_port change.","how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed kernel release listed in the advisory, which the sources do not name\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the affected tty_port code, most likely hosts with serial or TTY-backed hardware where ports can be hung up or powered down. Systems without such devices are unlikely to hit the race, but the sources do not say which configurations are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3442,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98753':16A,19A 'access':141C,148C 'activ':84B,104C,116C,179C 'attempt':49B,121C 'avoid':133C 'close':173C 'cve':14A,17A 'derefer':72B,146C 'deregist':152C 'describ':61B 'driver':185C 'due':138C 'error':80B,102C,113C 'fail':85B,117C,186C 'failur':105C,180C 'fix':75B 'flag':81B,114C,166C 'follow':91C 'gone':55B,127C 'handl':188C 'hangup':35B,160C,192C 'host':26B 'i/o':47B,120C 'io':79B,101C,112C 'ioctl':7A,32B,157C,191C 'ioctl-hangup':190C 'issu':134C 'kernel':2A,22B,66B,89C,136C 'leav':39B,181C 'let':6A 'like':135C 'linux':1A,21B,88C 'linux-kernel':20B 'make':106C 'note':163C 'null':70B,144C 'null-point':69B,143C 'open':37B,162C 'panic':67B,137C 'pointer':71B,145C 'port':4A,13A,42B,52B,83B,98C,124C,153C,172C 'possibl':65B 'power':11A,57B,129C,149C 'powered-down':10A 'prevent':119C 'race':5A,28B,158C,193C 'reach':8A 'resolv':95C 'restor':76B,99C,109C,176C 'result':63B 'runtim':23B 'self':25B 'self-host':24B 'set':168C 'sourc':60B 'specif':132C 'state':45B 'sure':107C 'tti':3A,31B,41B,78B,96C,97C,100C,111C,156C,171C 'unclock':140C 'vulner':92C 'window':183C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected tty_port code, most likely hosts with serial or TTY-backed hardware where ports can be hung up or powered down. Systems without such devices are unlikely to hit the race, but the sources do not say which configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98753","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-21T13:21:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}