In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in… (CVE-2026-98839)

The vulnerability in the Linux kernel's vt selection subsystem involves the paste_selection() function, which copies data from a selection buffer to the tty line discipline receive buffer. The function uses a loop that copies a calculated number of bytes per iteration and increments a 'pasted' counter. However, the selection mutex is released inside the loop, allowing a concurrent TIOCLINUX ioctl to replace the selection buffer with a shorter one and reduce its length below the current 'pasted' value. When paste_selection() resumes, the subtraction vc_sel.buf_len - pasted underflows as an unsigned integer, resulting in a large positive value. This causes tty_ldisc_receive_buf() to read up to 4094 bytes out-of-bounds past the buffer, leading to a slab-out-of-bounds read detected by KASAN. The fix terminates the loop when pasted is greater than or equal to vc_sel.buf_len, preventing the underflow and out-of-bounds access.

The vulnerability can cause out-of-bounds reads in kernel memory, potentially leading to kernel crashes or memory corruption. Although no active exploits are known, such memory safety issues can be leveraged for denial of service or potentially privilege escalation in certain contexts.

A fix has been implemented in the Linux kernel to terminate the loop in paste_selection() when the pasted counter reaches or exceeds the buffer length, preventing the unsigned underflow and out-of-bounds read. Users should apply the official kernel update containing this fix once available. No other mitigations are indicated.