CVE-2026-98751 tty: abort break signalling on hangup

In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should stil...

CVE-2026-98751 tty: abort break signalling on hangup

In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should stil...

CVE-2026-98751

The Linux kernel contains a vulnerability where break ioctls can race with a hangup operation. This race condition may cause the system to call into a tty driver for a device that is already powered down or gone. To resolve this, drivers must handle the race by aborting TCSBRK and TCSBRKP to prev...

CVE-2026-98752

The Linux kernel contains a race condition in the tty_port_tty_vhangup() function. This issue occurs when the function races with another hangup, potentially returning before the port is fully shut down. This flaw can lead to use-after-free and NULL-pointer dereferences during racing ioctls (incl...

EUVD-2026-103837

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98751

In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should stil...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

EUVD-2026-103835

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750

The Linux kernel contains a vulnerability in the tty subsystem where a race condition between closing a TTY (saving its termios) and the re-registration of a device can occur. This happens when a minor number is reused for a different device, potentially leading to a use-after-free condition. To ...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98749 tty: serial: max3100: shut down timer before freeing port

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

CVE-2026-98749

The Linux kernel contains a vulnerability in the tty: serial: max3100 driver. During system suspend, the max3100_shutdown() function returns early without fully stopping the polling timer. If the SPI device is unbound before resume, the serial core fails to call the shutdown function again, causi...

CVE-2026-98749 tty: serial: max3100: shut down timer before freeing port

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

EUVD-2026-103834

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

CVE-2026-98748 serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

CVE-2026-98748

The Linux kernel contains a use-after-free vulnerability in the brcmuart_remove() function associated with the 8250_bcm7271 serial driver. The root cause occurs when a receive-timeout interrupt arrives between the cancellation of the high-resolution timer (hrtimer) and the unregistering of the po...

EUVD-2026-103833

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...