CVE-2026-98752

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: port: fix tty_port_tty_vhangup() race

Drivers rely on tty_port_tty_vhangup() to synchronously hang up their

ports before tearing down resources as part of deregistration (e.g. on

physical disconnect).

If tty_port_tty_vhangup() races with another hangup it may however

return before the port has been shut down. This is in turn can lead to

use-after-free and NULL-pointer dereferences in racing ioctls (including

a synchronous hangup) and in processing of racing asynchronous hangups

(carrier loss).

Add the missing serialisation to tty_port_tty_vhangup() and

tty_port_hangup() so that the former does not return until the port has

been shut down also when there is a racing hangup.

Note that serial core does not use tty_port_hangup(), but it already

holds the port mutex when clearing port->tty and shutting down the port

in uart_hangup().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References