CVE-2026-5398: Kernel use-after-free bug in the TIOCNOTTY handler
The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory.
A malicious process can abuse the dangling pointer to grant itself root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5398?
CVE-2026-5398 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2026-5398?
To fix CVE-2026-5398, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-5398?
CVE-2026-5398 affects various versions of the Linux kernel where the TIOCNOTTY handler implementation is present.
What can happen if CVE-2026-5398 is exploited?
If exploited, CVE-2026-5398 can lead to a use-after-free condition, potentially allowing an attacker to execute arbitrary code.
Is there a workaround for CVE-2026-5398 if I cannot update?
There is no officially recommended workaround for CVE-2026-5398, so updating the kernel is the best course of action.