In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end… (CVE-2026-98695)

CVE-2026-98695 addresses a race condition in the Linux kernel USB serial driver where tty ioctl calls can race with device hangup events. This race can cause the driver to call into a tty driver for a device that no longer exists or is powered down, leading to a NULL-pointer dereference during extended break signaling. The vulnerability is mitigated by serializing callbacks using the tty port mutex and adding checks to ensure the port has not been hung up before accessing driver data or hardware. The ioctls TIOCGICOUNT and TIOCMIWAIT do not access driver data or hardware and are unaffected by this race.

If exploited, this race condition could cause kernel NULL-pointer dereferences, potentially leading to system instability or crashes when a USB serial device is disconnected during certain ioctl operations. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to serialize callbacks and add necessary checks to prevent accessing driver data after device hangup. Users should update to the patched kernel version once available. No additional mitigation is indicated.