CVE-2026-74675: Linux Kernel Race Condition Vulnerability

CVE-2026-74675 Overview

CVE-2026-74675 is a race condition in the Linux kernel virtual terminal (VT) subsystem. The kbd_keycode() function reads vc->port.tty without acquiring a proper tty reference. This creates a race window against con_shutdown(), which clears port.tty while holding a different lock. Without a stable reference, concurrent execution can lead to use-after-free conditions on the tty pointer. The fix introduces tty_port_tty_get() and tty_kref_put() to hold a valid reference for the duration the pointer is dereferenced.

Critical Impact
A local, authenticated attacker can trigger a use-after-free in the VT keyboard handling path, potentially leading to kernel memory corruption, denial of service, or local privilege escalation.

Affected Products

Linux kernel versions prior to the fixed commits in mainline and stable trees
Linux distributions shipping kernels with the vulnerable drivers/tty/vt/keyboard.c code path
Systems using the virtual terminal (VT) subsystem for console input

Discovery Timeline

2026-08-22 - CVE-2026-74675 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in the NVD database

Technical Details for CVE-2026-74675

Vulnerability Analysis

The vulnerability resides in the Linux kernel's virtual terminal keyboard handling code. Specifically, kbd_keycode() in the VT subsystem accesses the tty pointer stored at vc->port.tty without taking a reference count. Concurrently, con_shutdown() can null out that same pointer while holding a different lock, so the two paths are not mutually exclusive.

This lock asymmetry allows kbd_keycode() to observe a tty pointer that becomes freed mid-execution. Subsequent dereferences operate on freed memory, producing a classic use-after-free scenario in kernel space. Because the affected code runs in interrupt or process context handling keyboard input, an attacker with local access and the ability to trigger console teardown races can influence the outcome.

Root Cause

The root cause is inconsistent locking discipline around vc->port.tty. The reader (kbd_keycode()) did not use the tty port reference-counting API, while the writer (con_shutdown()) cleared the pointer under a lock that the reader does not honor. Without tty_port_tty_get(), there was no guarantee that the tty structure remained valid between the read and the dereference.

Attack Vector

Exploitation requires local access with low privileges. An attacker triggers keyboard input activity on a virtual console while concurrently forcing console shutdown or teardown operations. Winning the race exposes freed tty memory to the keyboard input path, which the attacker can leverage for kernel memory corruption. Detailed technical context is available in the upstream fixes referenced by the Kernel Git Commit 3840067 and the Kernel Git Commit cc4a1a2.

No public proof-of-concept exploit code is available. The vulnerability is described in prose based on the upstream commit messages.

Detection Methods for CVE-2026-74675

Indicators of Compromise

Unexpected kernel oops or panic messages referencing kbd_keycode, con_shutdown, or tty port structures in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports of use-after-free in the VT keyboard code path on instrumented kernels
Repeated console session teardowns coinciding with active keyboard input from unprivileged users

Detection Strategies

Monitor kernel logs for crash signatures involving drivers/tty/vt/keyboard.c and tty reference handling
Compare running kernel version and build metadata against distribution advisories referencing CVE-2026-74675
Correlate local user activity with kernel warnings tied to VT subsystem teardown races

Monitoring Recommendations

Aggregate kernel logs centrally and alert on new oops or KASAN reports referencing tty or VT code
Track kernel package versions across the fleet to identify hosts still running vulnerable builds
Baseline expected console and keyboard activity to detect anomalous local session churn

How to Mitigate CVE-2026-74675

Immediate Actions Required

Inventory Linux hosts and identify kernels missing the upstream fix commits listed in the NVD references
Apply vendor-supplied kernel updates from your Linux distribution as soon as they are available
Restrict local shell access on multi-user systems to reduce exposure to local race-condition exploitation
Reboot hosts after patching to ensure the fixed kernel is active

Patch Information

The fix replaces the unsafe read of vc->port.tty with tty_port_tty_get() to obtain a counted reference, paired with tty_kref_put() when the pointer is no longer needed. The upstream patches are available at Kernel Git Commit 3840067, Kernel Git Commit 38a0aa5, Kernel Git Commit 3f6b1d3, Kernel Git Commit b664592, Kernel Git Commit b84fd40, Kernel Git Commit cab5a34, Kernel Git Commit cc4a1a2, and Kernel Git Commit e25d47a.

Workarounds

Limit local login access to trusted users until the kernel patch is deployed
Disable virtual terminal access where it is not operationally required, for example on headless servers
Enforce least-privilege policies to reduce the population of accounts able to trigger the race locally

bash

# Verify running kernel version and cross-check against distribution advisories
uname -r

# Example: apply pending kernel updates on Debian/Ubuntu-based systems
sudo apt update && sudo apt upgrade -y linux-image-$(uname -r | cut -d- -f2-)
sudo reboot