---
id: CVE-2026-98754
title: 'tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

  vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
  with vcc_event() LDC callback…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb <
    57753441ef84bee3bf0e9ee1e3778d119c44aa32
  - >-
    Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb <
    88f6ecb058801e9ce7b9aabc966530118d7cd53c
  - >-
    Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb <
    821050631750e982007c0856c119346edba51cae
  - >-
    Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb <
    1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4
  - >-
    Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb <
    03b49c991abb8d021ca6fe51cd173447236b0552
  - Linux 4.14
published: '2026-10-18'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T06:55:48.861Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98754'
references:
  - url: 'https://git.kernel.org/stable/c/57753441ef84bee3bf0e9ee1e3778d119c44aa32'
  - url: 'https://git.kernel.org/stable/c/88f6ecb058801e9ce7b9aabc966530118d7cd53c'
  - url: 'https://git.kernel.org/stable/c/821050631750e982007c0856c119346edba51cae'
  - url: 'https://git.kernel.org/stable/c/1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4'
  - url: 'https://git.kernel.org/stable/c/03b49c991abb8d021ca6fe51cd173447236b0552'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98754.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98754'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555120'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98754'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98754'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98754.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.05988
ingestedAt: '2026-10-18T16:47:32.499Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
with vcc_event() LDC callbacks that read port->tty under port->lock and
then use tty->port. This can cause a use-after-free when the callback
dereferences tty->port after cleanup has already destroyed and freed it.

## Affected

- `Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb < 57753441ef84bee3bf0e9ee1e3778d119c44aa32`
- `Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb < 88f6ecb058801e9ce7b9aabc966530118d7cd53c`
- `Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb < 821050631750e982007c0856c119346edba51cae`
- `Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb < 1a9fb9eaeb69b1f6c00bed09289a33d9fe1e7ae4`
- `Linux >= 8f03f948ba356b7cb254b45a4e78b5b3d86fd3bb < 03b49c991abb8d021ca6fe51cd173447236b0552`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98754.json)