CVE-2026-98695

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98695", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.364Z", "datePublished": "2026-10-18T15:46:19.498Z", "dateUpdated": "2026-10-30T12:38:47.405Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:47.405Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix ioctl hangup race\n\nThe tty ioctls can race with hangup and end up calling into a tty driver\nfor a device that is already gone or powered down.\n\nSerialise the callbacks using the tty port mutex and add the missing\nchecks to make sure the port has not been hung up before accessing port\ndriver data or hardware.\n\nThis specifically avoids dereferencing a NULL-pointer if a device is\ndisconnected during lengthy break signalling.\n\nNote that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or\nhardware and are therefore not affected by the race."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/serial/generic.c", "drivers/usb/serial/usb-serial.c", "drivers/usb/serial/xr_serial.c"], "versions": [{"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "c7ef25e96dc3f808eb891bbbd43b6a682846eb0c", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "98f0a25134bfce44ebd1db0341fa0e8603ff276d", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "ae0da9a5c1ca95c20cc5feffd511ce6eae75924e", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "4597ddd6168ae2a4123404e5f0871f1070dc7773", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "7912a95d1345c77d8d63b530b00c118700b78abd", "status": "affected", "versionType": "git"}, {"version": "f34d7a5b7010b82fe97da95496b9971435530062", "lessThan": "ae0e61d95677efa778379853e495d748e6efbf95", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/serial/generic.c", "drivers/usb/serial/usb-serial.c", "drivers/usb/serial/xr_serial.c"], "versions": [{"version": "2.6.26", "status": "affected"}, {"version": "0", "lessThan": "2.6.26", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.26", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c7ef25e96dc3f808eb891bbbd43b6a682846eb0c"}, {"url": "https://git.kernel.org/stable/c/98f0a25134bfce44ebd1db0341fa0e8603ff276d"}, {"url": "https://git.kernel.org/stable/c/3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a"}, {"url": "https://git.kernel.org/stable/c/24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f"}, {"url": "https://git.kernel.org/stable/c/ae0da9a5c1ca95c20cc5feffd511ce6eae75924e"}, {"url": "https://git.kernel.org/stable/c/4597ddd6168ae2a4123404e5f0871f1070dc7773"}, {"url": "https://git.kernel.org/stable/c/7912a95d1345c77d8d63b530b00c118700b78abd"}, {"url": "https://git.kernel.org/stable/c/ae0e61d95677efa778379853e495d748e6efbf95"}], "title": "USB: serial: fix ioctl hangup race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/serial/generic.c", "drivers/usb/serial/usb-serial.c", "drivers/usb/serial/xr_serial.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c7ef25e96dc3f808eb891bbbd43b6a682846eb0c", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "98f0a25134bfce44ebd1db0341fa0e8603ff276d", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "ae0da9a5c1ca95c20cc5feffd511ce6eae75924e", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "4597ddd6168ae2a4123404e5f0871f1070dc7773", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "7912a95d1345c77d8d63b530b00c118700b78abd", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}, {"lessThan": "ae0e61d95677efa778379853e495d748e6efbf95", "status": "affected", "version": "f34d7a5b7010b82fe97da95496b9971435530062", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/serial/generic.c", "drivers/usb/serial/usb-serial.c", "drivers/usb/serial/xr_serial.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.26"}, {"lessThan": "2.6.26", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix ioctl hangup race\n\nThe tty ioctls can race with hangup and end up calling into a tty driver\nfor a device that is already gone or powered down.\n\nSerialise the callbacks using the tty port mutex and add the missing\nchecks to make sure the port has not been hung up before accessing port\ndriver data or hardware.\n\nThis specifically avoids dereferencing a NULL-pointer if a device is\ndisconnected during lengthy break signalling.\n\nNote that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or\nhardware and are therefore not affected by the race."}], "id": "CVE-2026-98695", "lastModified": "2026-10-30T13:21:18.557", "metrics": {}, "published": "2026-10-18T16:17:22.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24d6edb6bd7f7a9e6cee2f8fe435781daab8aa0f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a728adbed9fd822f99a9d9c5ebad5c3b565ba4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4597ddd6168ae2a4123404e5f0871f1070dc7773"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7912a95d1345c77d8d63b530b00c118700b78abd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/98f0a25134bfce44ebd1db0341fa0e8603ff276d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae0da9a5c1ca95c20cc5feffd511ce6eae75924e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae0e61d95677efa778379853e495d748e6efbf95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c7ef25e96dc3f808eb891bbbd43b6a682846eb0c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: USB: serial: fix ioctl hangup race", "id": "2555074", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555074"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nUSB: serial: fix ioctl hangup race\nThe tty ioctls can race with hangup and end up calling into a tty driver\nfor a device that is already gone or powered down.\nSerialise the callbacks using the tty port mutex and add the missing\nchecks to make sure the port has not been hung up before accessing port\ndriver data or hardware.\nThis specifically avoids dereferencing a NULL-pointer if a device is\ndisconnected during lengthy break signalling.\nNote that TIOCGICOUNT and TIOCMIWAIT do not access port driver data or\nhardware and are therefore not affected by the race.", "A flaw was found in the Linux kernel's USB serial subsystem. A local user could cause a Denial of Service (DoS) due to a race condition between input/output control (ioctl) operations and device disconnection. If a USB serial device is disconnected during an active operation, the driver may attempt to access released resources, triggering a null-pointer dereference and a system crash."], "name": "CVE-2026-98695", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98695\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98695\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98695.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f34d7a5b7010b82fe97da95496b9971435530062,ae0da9a5c1ca95c20cc5feffd511ce6eae75924e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f34d7a5b7010b82fe97da95496b9971435530062,4597ddd6168ae2a4123404e5f0871f1070dc7773)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f34d7a5b7010b82fe97da95496b9971435530062,7912a95d1345c77d8d63b530b00c118700b78abd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f34d7a5b7010b82fe97da95496b9971435530062,ae0e61d95677efa778379853e495d748e6efbf95)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.26"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.26)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.440067+00:00", "updated": "2026-10-22T21:15:12.498529+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}