CVE-2026-98839

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98839", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.373Z", "datePublished": "2026-10-18T15:50:11.869Z", "dateUpdated": "2026-10-19T09:26:31.558Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:31.558Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted >= vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n <TASK>\n dump_stack_lvl+0x70/0xa0\n print_report+0x153/0x4c6\n kasan_report+0xf1/0x120\n kasan_check_range+0x11c/0x200\n __asan_memcpy+0x29/0x70\n n_tty_receive_buf_common+0xa01/0x1650\n tty_ldisc_receive_buf+0x66/0x110\n tty_port_default_receive_buf+0x6b/0xb0\n flush_to_ldisc+0x1b4/0x410\n process_one_work+0x6ff/0x1110\n worker_thread+0x4a8/0xb70\n kthread+0x307/0x3e0\n ret_from_fork+0x3ed/0x680\n </TASK>\n =================================================================="}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/selection.c"], "versions": [{"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "lessThan": "037d7e3ca5c593092f4b0d471eb869a85cbddde0", "status": "affected", "versionType": "git"}, {"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "lessThan": "619c6d7dd76fff15a9714fbf02ce299b737f01a2", "status": "affected", "versionType": "git"}, {"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "lessThan": "39495ef5d6f8019e62d65807f217a7ca8232727a", "status": "affected", "versionType": "git"}, {"version": "54c522782fd11a720f959ee9cb5a15bb9580343d", "status": "affected", "versionType": "git"}, {"version": "05c508edc9d0b44e4706d3c2cf14ee12aac210d2", "status": "affected", "versionType": "git"}, {"version": "e5be0e24ffc7f5783a3864b5b958088ed15be9e8", "status": "affected", "versionType": "git"}, {"version": "a4719f6d07b2c63223f7452c435c5f578f105cfe", "status": "affected", "versionType": "git"}, {"version": "b4492f1e7456bd162714c0ec2815c2749d930844", "status": "affected", "versionType": "git"}, {"version": "9a9c13ad21a8220cb70c9807a920f43520515f94", "status": "affected", "versionType": "git"}, {"version": "8c368d36878e2fc99285279fc5e14b3d3cb8947c", "status": "affected", "versionType": "git"}, {"version": "3.16.83", "lessThan": "3.17", "status": "affected", "versionType": "semver"}, {"version": "4.4.216", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.216", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.173", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.109", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.25", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.5.9", "lessThan": "5.6", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/selection.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.173"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0"}, {"url": "https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2"}, {"url": "https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}], "title": "vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/vt/selection.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "037d7e3ca5c593092f4b0d471eb869a85cbddde0", "status": "affected", "version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "versionType": "git"}, {"lessThan": "619c6d7dd76fff15a9714fbf02ce299b737f01a2", "status": "affected", "version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "versionType": "git"}, {"lessThan": "39495ef5d6f8019e62d65807f217a7ca8232727a", "status": "affected", "version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2", "versionType": "git"}, {"status": "affected", "version": "54c522782fd11a720f959ee9cb5a15bb9580343d", "versionType": "git"}, {"status": "affected", "version": "05c508edc9d0b44e4706d3c2cf14ee12aac210d2", "versionType": "git"}, {"status": "affected", "version": "e5be0e24ffc7f5783a3864b5b958088ed15be9e8", "versionType": "git"}, {"status": "affected", "version": "a4719f6d07b2c63223f7452c435c5f578f105cfe", "versionType": "git"}, {"status": "affected", "version": "b4492f1e7456bd162714c0ec2815c2749d930844", "versionType": "git"}, {"status": "affected", "version": "9a9c13ad21a8220cb70c9807a920f43520515f94", "versionType": "git"}, {"status": "affected", "version": "8c368d36878e2fc99285279fc5e14b3d3cb8947c", "versionType": "git"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.83", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.216", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.216", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.173", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.109", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.25", "versionType": "semver"}, {"lessThan": "5.6", "status": "affected", "version": "5.5.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/vt/selection.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted >= vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n <TASK>\n dump_stack_lvl+0x70/0xa0\n print_report+0x153/0x4c6\n kasan_report+0xf1/0x120\n kasan_check_range+0x11c/0x200\n __asan_memcpy+0x29/0x70\n n_tty_receive_buf_common+0xa01/0x1650\n tty_ldisc_receive_buf+0x66/0x110\n tty_port_default_receive_buf+0x6b/0xb0\n flush_to_ldisc+0x1b4/0x410\n process_one_work+0x6ff/0x1110\n worker_thread+0x4a8/0xb70\n kthread+0x307/0x3e0\n ret_from_fork+0x3ed/0x680\n </TASK>\n =================================================================="}], "id": "CVE-2026-98839", "lastModified": "2026-10-19T10:19:47.957", "metrics": {}, "published": "2026-10-18T16:17:38.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()", "id": "2555258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555258"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's virtual terminal selection subsystem. When pasting console selections, a race condition can occur if another process concurrently replaces the selection buffer with shorter content while the operation is temporarily paused. This situation causes an integer underflow that leads to an out-of-bounds memory read. A local user can exploit this vulnerability to cause a system crash, resulting in a Denial of Service (DoS), or potentially expose sensitive kernel memory."], "name": "CVE-2026-98839", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98839\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98839\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98839.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2,037d7e3ca5c593092f4b0d471eb869a85cbddde0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2,619c6d7dd76fff15a9714fbf02ce299b737f01a2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2,39495ef5d6f8019e62d65807f217a7ca8232727a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "54c522782fd11a720f959ee9cb5a15bb9580343d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "05c508edc9d0b44e4706d3c2cf14ee12aac210d2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e5be0e24ffc7f5783a3864b5b958088ed15be9e8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a4719f6d07b2c63223f7452c435c5f578f105cfe"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b4492f1e7456bd162714c0ec2815c2749d930844"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "9a9c13ad21a8220cb70c9807a920f43520515f94"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8c368d36878e2fc99285279fc5e14b3d3cb8947c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.16.83,3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.4.216,4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.9.216,4.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.14.173,4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.19.109,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.4.25,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.5.9,5.6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.56,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.10,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:00:20.103778+00:00", "updated": "2026-10-24T05:00:19.713927+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}