In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup()… (CVE-2026-98754)

The Linux kernel vulnerability CVE-2026-98754 involves a race condition in the tty vcc driver. Specifically, the function vcc_cleanup() sets port->tty to NULL without acquiring the port lock, while vcc_event() LDC callbacks access port->tty under the lock and then use tty->port. This race can cause a use-after-free condition when the callback dereferences tty->port after it has been destroyed and freed. The vulnerability has been resolved by ensuring the port lock is held when clearing the tty pointer in vcc_cleanup().

This vulnerability can cause a use-after-free condition in the Linux kernel, potentially leading to kernel memory corruption or system instability. The exact impact depends on how the kernel handles the use-after-free scenario, but it could be leveraged for privilege escalation or denial of service.

A fix has been implemented in the Linux kernel to hold the port lock when clearing the tty pointer in vcc_cleanup(), eliminating the race condition. Users should apply the official kernel update or patch that includes this fix. No additional mitigations are indicated.