{"id":"CVE-2026-98839","kind":"vulnerability","aliases":["CVE-2026-98839"],"related":[],"title":"Linux kernel: console selection paste can read past buffer end","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted >= vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x70/0xa0\n  print_report+0x153/0x4c6\n  kasan_report+0xf1/0x120\n  kasan_check_range+0x11c/0x200\n  __asan_memcpy+0x29/0x70\n  n_tty_receive_buf_common+0xa01/0x1650\n  tty_ldisc_receive_buf+0x66/0x110\n  tty_port_default_receive_buf+0x6b/0xb0\n  flush_to_ldisc+0x1b4/0x410\n  process_one_work+0x6ff/0x1110\n  worker_thread+0x4a8/0xb70\n  kthread+0x307/0x3e0\n  ret_from_fork+0x3ed/0x680\n  </TASK>\n ==================================================================","summary":"A race in the Linux virtual terminal selection code lets a concurrent TIOCLINUX selection change shrink the buffer while a paste is in progress, causing an unsigned underflow. The kernel then reads up to 4094 bytes out of bounds from a slab allocation, which KASAN reports as a slab-out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted"],"not_affected_if":["no-local-users"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel build that includes the upstream fix titled 'vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()'; the sources do not name a fixed version.","status":"open","published_at":"2026-10-18T16:17:38+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:13+00:00","updated_at":"2026-10-25T05:13:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream fix titled 'vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()'; the sources do not name a fixed version.","reach":"local","title":"Linux kernel: console selection paste can read past buffer end","impact":"medium","summary":"A race in the Linux virtual terminal selection code lets a concurrent TIOCLINUX selection change shrink the buffer while a paste is in progress, causing an unsigned underflow. The kernel then reads up to 4094 bytes out of bounds from a slab allocation, which KASAN reports as a slab-out-of-bounds read.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"local user may read kernel slab memory, possibly crash the kernel","analyst_note":"Check the upstream kernel commit and stable backports for the fixed version ranges at https://nvd.nist.gov/vuln/detail/CVE-2026-98839.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Linux systems with virtual terminals (the console) where a local process can issue TIOCLINUX selection ioctls while a paste is pending. The sources do not say which kernel versions are affected beyond the reported 7.3.0-rc3 trace. Systems without virtual consoles in use have less exposure; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4046,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':246C,270C,274C,278C,283C,287C,294C,300C,307C,312C,317C,321C,324C,329C '-2026':12A,15A '-98839':13A,16A '1/65':258C '4094':58B,206C,251C '7.3.0':231C 'addr':253C 'alloc':66B,215C 'asan':285C 'bound':62B,76B,98C,211C,239C 'buf':126C,196C,244C,292C,299C,306C 'buffer':9A,41B,145C 'bug':233C 'byte':59B,119C,207C 'call':265C 'caus':48B,192C 'chang':38B 'check':281C 'code':32B 'common':245C,293C 'concurr':35B,157C 'consol':3A 'copi':108C 'count':130C,201C 'cve':11A,14A 'default':304C 'disciplin':144C 'drop':137C 'dump':267C 'end':10A 'event':260C 'ffff888101c58010':254C 'fill':146C 'fix':90C,217C 'flush':262C,309C 'follow':83C 'fork':328C 'host':23B 'increment':128C 'infrastructur':17B 'insid':138C 'int':112C 'integ':186C 'ioctl':161C 'iter':121C 'kasan':68B,234C,276C,280C 'kernel':2A,20B,53B,81C,227C 'kthread':323C 'kworker/u17':257C 'larg':189C 'ld':197C 'ldisc':124C,194C,264C,297C,311C 'len':114C,172C,180C,226C 'let':33B 'line':143C 'linux':1A,19B,28B,80C,230C 'linux-kernel':18B 'loop':107C,140C,222C 'lvl':269C 'memcpi':286C 'min':109C 'mutex':134C 'n':241C,289C 'newli':214C 'null':200C 'one':315C 'out-of-bound':208C 'past':5A,8A,44B,101C,104C,115C,129C,149C,174C,176C,181C,199C,212C,224C 'per':120C 'port':303C 'posit':190C 'print':272C 'process':314C 'progress':47B 'race':25B 'rang':282C 'rc3':232C 'read':7A,55B,77B,99C,203C,248C 'receiv':117C,125C,195C,243C,291C,298C,305C 'reduc':170C 'replac':163C 'report':69B,273C,277C 'resolv':87C 'resum':178C 'ret':326C 'room':118C 'select':4A,31B,37B,89C,102C,105C,133C,150C,168C,177C 'self':22B 'self-host':21B 'setsel':160C 'shorter':167C 'shrink':39B 'size':250C 'slab':65B,73B,95C,236C 'slab-out-of-bound':72B,94C,235C 'sleep':151C 'stack':228C,268C 'task':256C 'termin':30B,220C 'thread':320C 'tiocl':159C 'tioclinux':36B,158C 'trace':229C,266C 'tti':116C,123C,153C,193C,242C,290C,296C,302C 'unbound':261C 'underflow':51B,92C,182C 'unsign':50B,91C,111C,185C 'valu':191C 'vc_sel.buf':113C,171C,179C,225C 'vc_sel.buffer':164C,198C,216C 'vc_sel.lock':135C 'virtual':29B 'vt':88C 'vulner':84C 'wait':155C 'whenev':141C 'work':316C 'worker':319C 'workqueu':259C 'write':154C 'x11c/0x200':284C 'x153/0x4c6':275C 'x1b4/0x410':313C 'x29/0x70':288C 'x307/0x3e0':325C 'x3ed/0x680':330C 'x4a8/0xb70':322C 'x66/0x110':301C 'x6b/0xb0':308C 'x6ff/0x1110':318C 'x70/0xa0':271C 'xa01/0x1650':247C,295C 'xf1/0x120':279C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux systems with virtual terminals (the console) where a local process can issue TIOCLINUX selection ioctls while a paste is pending. The sources do not say which kernel versions are affected beyond the reported 7.3.0-rc3 trace. Systems without virtual consoles in use have less exposure; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98839","severity":null,"published_at":"2026-10-18T16:17:38+00:00","modified_at":"2026-10-19T10:19:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}