{"id":"CVE-2026-98754","kind":"vulnerability","aliases":["CVE-2026-98754"],"related":[],"title":"Linux kernel: race in vcc driver can cause use-after-free on tty cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: hold port lock when clearing tty pointer in vcc_cleanup\n\nvcc_cleanup() sets port->tty to NULL without holding port->lock, racing\nwith vcc_event() LDC callbacks that read port->tty under port->lock and\nthen use tty->port. This can cause a use-after-free when the callback\ndereferences tty->port after cleanup has already destroyed and freed it.","summary":"The Linux kernel's vcc (Sun LDOM virtual console) driver clears a tty pointer without holding the port lock, so an LDC event callback can run concurrently and dereference a tty that was already freed. The sources describe this as a use-after-free, which can crash the kernel or be abused for code execution, but they do not state a severity or exploitability.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ldom","linux-kernel","other","sparc","virtualized-guests"],"not_affected_if":["vcc-driver-not-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel versions listed in the NVD entry (unknown from the sources)\n- Check whether the vcc driver is in use: `lsmod | grep vcc` or `grep -r vcc /proc/devices` (unknown from the sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup' (exact version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:54+00:00","updated_at":"2026-10-25T05:16:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:16:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup' (exact version unknown from the sources)","reach":"local","title":"Linux kernel: race in vcc driver can cause use-after-free on tty cleanup","impact":"high","summary":"The Linux kernel's vcc (Sun LDOM virtual console) driver clears a tty pointer without holding the port lock, so an LDC event callback can run concurrently and dereference a tty that was already freed. The sources describe this as a use-after-free, which can crash the kernel or be abused for code execution, but they do not state a severity or exploitability.","category":"other","nicknames":[],"who_cares":["linux-kernel","sparc","ldom","virtualized-guests"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption from a use-after-free; possible crash or privilege escalation","analyst_note":"Find the affected and fixed kernel version ranges and the upstream fix commit from the NVD entry or the kernel stable mailing list, and confirm whether the flaw is reachable without local access.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel versions listed in the NVD entry (unknown from the sources)\n- Check whether the vcc driver is in use: `lsmod | grep vcc` or `grep -r vcc /proc/devices` (unknown from the sources)","needs_analyst":true,"not_affected_if":["vcc-driver-not-loaded"],"who_is_affected":"The flaw is in the vcc virtual console driver, which is relevant to Linux guests running on Sun/Oracle LDOM-style virtualized SPARC systems that use LDC channels. Systems without this driver loaded are unlikely to be affected. The sources do not say which kernel versions are impacted.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":3370,"output_tokens":697,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98754':18A,21A 'abus':83B 'alreadi':64B,164C 'callback':54B,134C,157C 'caus':8A,149C 'cleanup':15A,117C,119C,162C 'clear':41B,112C 'code':85B 'concurr':57B 'consol':39B 'crash':78B 'cve':16A,19A 'derefer':59B,158C 'describ':68B 'destroy':165C 'driver':6A,40B 'event':53B,132C 'execut':86B 'exploit':95B 'follow':101C 'free':12A,75B,154C 'freed':65B,167C 'guest':30B 'hold':46B,108C,126C 'kernel':2A,25B,33B,80B,99C 'ldc':52B,133C 'ldom':22B,37B 'linux':1A,24B,32B,98C 'linux-kernel':23B 'lock':49B,110C,128C,141C 'null':124C 'pointer':44B,114C 'port':48B,109C,121C,127C,137C,140C,146C,160C 'race':3A,129C 'read':136C 'resolv':105C 'run':56B 'set':120C 'sever':93B 'sourc':67B 'sparc':27B 'state':91B 'sun':36B 'tti':14A,43B,61B,106C,113C,122C,138C,145C,159C 'use':10A,73B,144C,152C 'use-after-fre':9A,72B,151C 'vcc':5A,35B,107C,116C,118C,131C 'virtual':29B,38B 'virtualized-guest':28B 'vulner':102C 'without':45B,125C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the vcc virtual console driver, which is relevant to Linux guests running on Sun/Oracle LDOM-style virtualized SPARC systems that use LDC channels. Systems without this driver loaded are unlikely to be affected. The sources do not say which kernel versions are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98754","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-21T13:21:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}