CVE-2026-98752: tty: port: fix tty_port_tty_vhangup() race
In the Linux kernel, the following vulnerability has been resolved:
tty: port: fix ttyportttyvhangup() race
Drivers rely on ttyportttyvhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect).
If ttyportttyvhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss).
Add the missing serialisation to ttyportttyvhangup() and ttyporthangup() so that the former does not return until the port has been shut down also when there is a racing hangup.
Note that serial core does not use ttyporthangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uarthangup().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue requires tty port teardown or deregistration to race with another hangup. The affected races can involve ioctls, including a synchronous hangup, or asynchronous hangups caused by carrier loss.
What is the practical impact of a successful race?
A racing hangup can allow tty_port_tty_vhangup() to return before the port is fully shut down. Subsequent racing operations may cause use-after-free or NULL-pointer dereference conditions.
What should maintainers do if their driver uses tty_port_tty_vhangup() during teardown?
Apply a kernel version containing the added serialization in tty_port_tty_vhangup() and tty_port_hangup(). Drivers that depend on synchronous hangup completion before releasing port resources are the relevant exposure area.