CVE-2026-74675: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In the Linux kernel, the following vulnerability has been resolved:
vt: stabilize tty reference in kbdkeycode with ttyportttyget
kbdkeycode() reads vc->port.tty without acquiring a tty reference, racing against conshutdown() which clears port.tty under a different lock. Use ttyportttyget()/ttykrefput() to hold a proper reference for the duration the tty pointer is needed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What runtime condition is required for this race to occur?
kbd_keycode() must access the virtual console's tty pointer while con_shutdown() is concurrently clearing that pointer. The issue is a missing tty reference during that access.
Does the provided information identify affected kernel versions or a temporary mitigation?
No affected-version range, fixed release version, configuration prerequisite, or workaround is provided. The available references point to stable kernel commits containing the resolution.