CVE-2026-98750Medium· 4.7▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
— → 4.7
none → medium
0.2% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
tty: fix saved termios reset race
Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set).
Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration.
Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.
Linux >= 93857edd9829e144acb6c7e72d593f6e01aead66 < 6b4e15cccfbe03b7c6ae60ff570c401bfb1e51d6Linux >= 93857edd9829e144acb6c7e72d593f6e01aead66 < 1572d86bcf0bcb848d20fc5e5de7ed6963034c2bLinux >= 93857edd9829e144acb6c7e72d593f6e01aead66 < 08bf919f041af9de372428bb0c938157ea144164Linux >= 93857edd9829e144acb6c7e72d593f6e01aead66 < dcaf0251f847a45861e94c6617024a9455687d2fLinux >= 93857edd9829e144acb6c7e72d593f6e01aead66 < 8df07fe93573e9e548d6645273e9bcb6eb74059eLinux 4.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing