In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on… (CVE-2026-98752)

The Linux kernel contained a race condition in the tty port subsystem where tty_port_tty_vhangup() could return prematurely if it raced with another hangup operation. This premature return could lead to use-after-free and NULL-pointer dereference vulnerabilities during racing ioctl calls or asynchronous hangups such as carrier loss. The vulnerability was addressed by adding missing serialization between tty_port_tty_vhangup() and tty_port_hangup(), ensuring that tty_port_tty_vhangup() only returns after the port has been fully shut down, eliminating the race condition. The serial core was not affected as it already holds the port mutex during hangup.

This vulnerability could lead to use-after-free and NULL-pointer dereference conditions in the Linux kernel's tty port handling, potentially causing kernel crashes or undefined behavior when racing ioctl or hangup operations occur. There is no indication of known exploits in the wild. The impact is limited to kernel stability and security related to tty port deregistration.

A fix has been implemented in the Linux kernel by adding serialization to the tty_port_tty_vhangup() and tty_port_hangup() functions. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation.