Live › vulnerability › CVE-2026-98839
Go to dashboardA race in the Linux virtual terminal selection code lets a concurrent TIOCLINUX selection change shrink the buffer while a paste is in progress, causing an unsigned underflow. The kernel then reads up to 4094 bytes out of bounds from a slab allocation, which KASAN reports as a slab-out-of-bounds read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affects Linux systems with virtual terminals (the console) where a local process can issue TIOCLINUX selection ioctls while a paste is pending. The sources do not say which kernel versions are affected beyond the reported 7.3.0-rc3 trace. Systems without virtual consoles in use have less exposure; the sources do not say more.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count.
Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted.
When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.
Fix this by terminating the loop when pasted >= vc_sel.buf_len.
This page as .md · .json · in your agent: get_signal("CVE-2026-98839")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.