tty: fix saved termios reset race
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.
CVE-2026-98750
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98750
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "93857edd9829e144acb6c7e72d593f6e01aead66",
"lessThan": "6b4e15cccfbe03b7c6ae60ff570c401bfb1e51d6",
"versionType": "git"
},
{
"status": "affected",
"version": "93857edd9829e144acb6c7e72d593f6e01aead66",
"lessThan": "1572d86bcf0bcb848d20fc5e5de7ed6963034c2b",
"versionType": "git"
},
{
"status": "affected",
"version": "93857edd9829e144acb6c7e72d593f6e01aead66",
"lessThan": "08bf919f041af9de372428bb0c938157ea144164",
"versionType": "git"
},
{
"status": "affected",
"version": "93857edd9829e144acb6c7e72d593f6e01aead66",
"lessThan": "dcaf0251f847a45861e94c6617024a9455687d2f",
"versionType": "git"
},
{
"status": "affected",
"version": "93857edd9829e144acb6c7e72d593f6e01aead66",
"lessThan": "8df07fe93573e9e548d6645273e9bcb6eb74059e",
"versionType": "git"
}
],
"programFiles": [
"drivers/staging/greybus/uart.c",
"drivers/tty/tty_io.c",
"drivers/usb/class/cdc-acm.c",
"drivers/usb/serial/usb-serial.c",
"include/linux/tty_driver.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/staging/greybus/uart.c",
"drivers/tty/tty_io.c",
"drivers/usb/class/cdc-acm.c",
"drivers/usb/serial/usb-serial.c",
"include/linux/tty_driver.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98750
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48947 · Revision 1
- Added to Heist Feed
- Publisher date