Skip to main content
VulnerabilityPublished

CVE-2026-98839: Linux kernel · vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

Affects Linux kernelSource CVE Database V5

0

Not known to be exploited · fixed in 39495ef5d6f8019e62d65807f217a7ca8232727a : patch Linux kernel soon.

Data as of 27 Oct 2026, 05:11 UTC

Severity
High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS
0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 39495ef5d6f8019e62d65807f217a7ca8232727a, 619c6d7dd76fff15a9714fbf02ce299b737f01a2, 037d7e3ca5c593092f4b0d471eb869a85cbddde0 +7

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 18 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • >=3.16.83 <3.17
  • >=4.4.216 <4.5
  • >=4.9.216 <4.10
  • >=4.14.173 <4.15
  • >=4.19.109 <4.20
  • >=5.4.25 <5.5
  • >=5.5.9 <5.6
Fixed in
  • 39495ef5d6f8019e62d65807f217a7ca8232727a
  • 619c6d7dd76fff15a9714fbf02ce299b737f01a2
  • 037d7e3ca5c593092f4b0d471eb869a85cbddde0
  • 5.6
  • 5.5
  • 4.20
  • 4.15
  • 4.10
  • 4.5
  • 3.17
LinuxLinuxAffected
  • =5.6
Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 5.6 and later. Users and administrators should upgrade to these fixed versions to remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's virtual terminal (vt) selection code allows an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. This occurs when a concurrent ioctl call replaces the selection buffer with a shorter one while paste_selection() is sleeping, causing the function to read memory beyond the allocated buffer. The issue has been fixed by terminating the loop when the pasted byte count reaches the buffer length.

References

Community reviews

Loading reviews…