{"id":"CVE-2026-98752","state":"PUBLISHED","title":"tty: port: fix tty_port_tty_vhangup() race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: port: fix tty_port_tty_vhangup() race\n\nDrivers rely on tty_port_tty_vhangup() to synchronously hang up their\nports before tearing down resources as part of deregistration (e.g. on\nphysical disconnect).\n\nIf tty_port_tty_vhangup() races with another hangup it may however\nreturn before the port has been shut down. This is in turn can lead to\nuse-after-free and NULL-pointer dereferences in racing ioctls (including\na synchronous hangup) and in processing of racing asynchronous hangups\n(carrier loss).\n\nAdd the missing serialisation to tty_port_tty_vhangup() and\ntty_port_hangup() so that the former does not return until the port has\nbeen shut down also when there is a racing hangup.\n\nNote that serial core does not use tty_port_hangup(), but it already\nholds the port mutex when clearing port->tty and shutting down the port\nin uart_hangup().","publishedAt":"2026-10-18T15:47:36.877Z","updatedAt":"2026-10-30T12:39:22.635Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"2e16ae1464a4f435425c6f6ff1e293db850a624c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a776d603d1e1bba2837295817b0a39394707b10d","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"ce220b4cdf62f73db0c1940f968eb33b9899fdd0","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6d1a984afc3ca477dab3e51ec806671d443ad524","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6b7be3b9b857947e9c1338d4919d4ebd3b75e907","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"017b18addbe8dcace1a569a00d40ed1ba1e03f4c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"b48820de8c1a596c5b99775524dfce73c6576c5d","versionType":"git"},{"version":"4260dc792fabfd20c8644fa9414b2ae48372365f","status":"affected","versionType":"git"},{"version":"2.6.31.2","status":"affected","lessThan":"2.6.32","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/tty_port.c","include/linux/tty_port.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.32","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/tty_port.c","include/linux/tty_port.h"]}],"references":["https://git.kernel.org/stable/c/a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","https://git.kernel.org/stable/c/2e16ae1464a4f435425c6f6ff1e293db850a624c","https://git.kernel.org/stable/c/a776d603d1e1bba2837295817b0a39394707b10d","https://git.kernel.org/stable/c/ce220b4cdf62f73db0c1940f968eb33b9899fdd0","https://git.kernel.org/stable/c/6d1a984afc3ca477dab3e51ec806671d443ad524","https://git.kernel.org/stable/c/6b7be3b9b857947e9c1338d4919d4ebd3b75e907","https://git.kernel.org/stable/c/017b18addbe8dcace1a569a00d40ed1ba1e03f4c","https://git.kernel.org/stable/c/b48820de8c1a596c5b99775524dfce73c6576c5d"],"weaknesses":[],"ingestedAt":"2026-10-30T12:58:04.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98752.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98752","state":"PUBLISHED","datePublished":"2026-10-18T15:47:36.877Z","dateUpdated":"2026-10-30T12:39:22.635Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.368Z"},"containers":{"cna":{"title":"tty: port: fix tty_port_tty_vhangup() race","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: port: fix tty_port_tty_vhangup() race\n\nDrivers rely on tty_port_tty_vhangup() to synchronously hang up their\nports before tearing down resources as part of deregistration (e.g. on\nphysical disconnect).\n\nIf tty_port_tty_vhangup() races with another hangup it may however\nreturn before the port has been shut down. This is in turn can lead to\nuse-after-free and NULL-pointer dereferences in racing ioctls (including\na synchronous hangup) and in processing of racing asynchronous hangups\n(carrier loss).\n\nAdd the missing serialisation to tty_port_tty_vhangup() and\ntty_port_hangup() so that the former does not return until the port has\nbeen shut down also when there is a racing hangup.\n\nNote that serial core does not use tty_port_hangup(), but it already\nholds the port mutex when clearing port->tty and shutting down the port\nin uart_hangup()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a78910f6d78cc1415cbc9b4fb621c3f4f6945be2","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"2e16ae1464a4f435425c6f6ff1e293db850a624c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"a776d603d1e1bba2837295817b0a39394707b10d","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"ce220b4cdf62f73db0c1940f968eb33b9899fdd0","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6d1a984afc3ca477dab3e51ec806671d443ad524","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"6b7be3b9b857947e9c1338d4919d4ebd3b75e907","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"017b18addbe8dcace1a569a00d40ed1ba1e03f4c","versionType":"git"},{"version":"7ca0ff9ab3218ec443a7a9ad247e4650373ed41e","status":"affected","lessThan":"b48820de8c1a596c5b99775524dfce73c6576c5d","versionType":"git"},{"version":"4260dc792fabfd20c8644fa9414b2ae48372365f","status":"affected","versionType":"git"},{"version":"2.6.31.2","status":"affected","lessThan":"2.6.32","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/tty_port.c","include/linux/tty_port.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.32","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/tty_port.c","include/linux/tty_port.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/a78910f6d78cc1415cbc9b4fb621c3f4f6945be2"},{"url":"https://git.kernel.org/stable/c/2e16ae1464a4f435425c6f6ff1e293db850a624c"},{"url":"https://git.kernel.org/stable/c/a776d603d1e1bba2837295817b0a39394707b10d"},{"url":"https://git.kernel.org/stable/c/ce220b4cdf62f73db0c1940f968eb33b9899fdd0"},{"url":"https://git.kernel.org/stable/c/6d1a984afc3ca477dab3e51ec806671d443ad524"},{"url":"https://git.kernel.org/stable/c/6b7be3b9b857947e9c1338d4919d4ebd3b75e907"},{"url":"https://git.kernel.org/stable/c/017b18addbe8dcace1a569a00d40ed1ba1e03f4c"},{"url":"https://git.kernel.org/stable/c/b48820de8c1a596c5b99775524dfce73c6576c5d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:39:22.635Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.31.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}