CVE-2026-98839

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

In paste_selection(), the loop copies min_t(unsigned int,

vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into

tty_ldisc_receive_buf() and increments pasted += count.

Because the selection mutex (vc_sel.lock) is dropped inside the loop

Whenever the line discipline buffer fills up and paste_selection()

sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl

can replace vc_sel.buffer with a shorter selection and reduce

vc_sel.buf_len below pasted.

When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an

unsigned integer to a large positive value, causing

tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read

up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.

Fix this by terminating the loop when pasted >= vc_sel.buf_len.

Kernel stack trace (Linux 7.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References