CVE-2026-98695 (GCVE-0-2026-98695)
Vulnerability from cvelistv5
Published
2026-10-18 15:46
Modified
2026-10-30 12:38
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware. This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling. Note that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or hardware and are therefore not affected by the race.
References
Impacted products
Vendor Product Version
Linux Linux Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
Version: f34d7a5b7010b82fe97da95496b9971435530062
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/generic.c",
            "drivers/usb/serial/usb-serial.c",
            "drivers/usb/serial/xr_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7ef25e96dc3f808eb891bbbd43b6a682846eb0c",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "98f0a25134bfce44ebd1db0341fa0e8603ff276d",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "ae0da9a5c1ca95c20cc5feffd511ce6eae75924e",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "4597ddd6168ae2a4123404e5f0871f1070dc7773",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "7912a95d1345c77d8d63b530b00c118700b78abd",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            },
            {
              "lessThan": "ae0e61d95677efa778379853e495d748e6efbf95",
              "status": "affected",
              "version": "f34d7a5b7010b82fe97da95496b9971435530062",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/generic.c",
            "drivers/usb/serial/usb-serial.c",
            "drivers/usb/serial/xr_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix ioctl hangup race\n\nThe tty ioctls can race with hangup and end up calling into a tty driver\nfor a device that is already gone or powered down.\n\nSerialise the callbacks using the tty port mutex and add the missing\nchecks to make sure the port has not been hung up before accessing port\ndriver data or hardware.\n\nThis specifically avoids dereferencing a NULL-pointer if a device is\ndisconnected during lengthy break signalling.\n\nNote that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or\nhardware and are therefore not affected by the race."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:38:47.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7ef25e96dc3f808eb891bbbd43b6a682846eb0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/98f0a25134bfce44ebd1db0341fa0e8603ff276d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0da9a5c1ca95c20cc5feffd511ce6eae75924e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4597ddd6168ae2a4123404e5f0871f1070dc7773"
        },
        {
          "url": "https://git.kernel.org/stable/c/7912a95d1345c77d8d63b530b00c118700b78abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0e61d95677efa778379853e495d748e6efbf95"
        }
      ],
      "title": "USB: serial: fix ioctl hangup race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98695",
    "datePublished": "2026-10-18T15:46:19.498Z",
    "dateReserved": "2026-09-25T10:25:14.364Z",
    "dateUpdated": "2026-10-30T12:38:47.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.