CVE-2026-98751: Linux Kernel TTY Race Condition Vulnerability

CVE-2026-98751 Overview

CVE-2026-98751 is a race condition vulnerability in the Linux kernel's TTY (teletypewriter) subsystem. The break ioctls TCSBRK and TCSBRKP can race with a device hangup event. This race allows the kernel to invoke a TTY driver callback for a device that has already been removed or powered down.

The flaw occurs when a user-controlled timeout tied to a break signal elapses after the TTY has been hung up. In some cases, the driver callback may fire after the TTY has been reopened, producing inconsistent driver state. The upstream fix aborts TCSBRK and TCSBRKP on hangup instead of re-entering the driver's break_ctl() path.

Critical Impact
A race between TTY break ioctls and hangup can cause the kernel to call into a driver after the underlying device is gone, leading to undefined driver behavior.

Affected Products

Linux kernel (upstream mainline)
Linux stable branches referenced by the kernel.org commits listed below
Distributions shipping kernels prior to the backported fixes

Discovery Timeline

2026-10-18 - CVE-2026-98751 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98751

Vulnerability Analysis

The Linux kernel exposes TCSBRK and TCSBRKP ioctls that direct a TTY driver to assert a break condition on a serial line for a caller-specified duration. Internally, the kernel schedules work that calls back into the driver's break_ctl() operation to clear the break state after the timeout.

The TTY layer processes hangup events asynchronously. If a hangup occurs while a break ioctl is in flight, the device backing the TTY may be torn down, unbound, or powered off before the pending break callback executes. The kernel can then dispatch break_ctl() against a driver whose state no longer matches a live device.

Because the break timeout is user-controlled, an unprivileged process holding an open file descriptor to a hang-prone TTY can widen the race window arbitrarily. The ioctl may complete and the TTY may be closed and reopened before the deferred callback fires, so the second break_ctl() call lands on an unrelated driver context.

Root Cause

The TTY break code path did not abort pending break operations on hangup. Drivers are expected to clear break state on shutdown, but the TTY layer continued to call break_ctl() a second time after the user-controlled delay. That second call races the hangup teardown and may execute against stale driver state.

Attack Vector

Exploitation requires local access and the ability to open a TTY device that is subject to hangup, such as a USB serial adapter that can be physically removed or a pseudo-TTY whose master side closes. An unprivileged process issues TCSBRK or TCSBRKP with a long timeout, then triggers or waits for hangup. The deferred driver callback executes against a device that is no longer valid.

The vulnerability is a kernel race condition in the TTY subsystem. See the upstream fixes at Kernel Commit 3bc82999, Kernel Commit 6c9c9367, Kernel Commit 845a2737, Kernel Commit 94af6cd8, and Kernel Commit c8ccd3b2 for the exact driver-interface changes.

Detection Methods for CVE-2026-98751

Indicators of Compromise

Kernel log messages from TTY or serial drivers indicating callbacks on devices that have been unbound or hung up.
Driver-specific warnings or WARN_ON splats originating from break_ctl() paths shortly after USB serial device removal or PTY master close.
Unexpected process stalls on ioctl(TCSBRK) or ioctl(TCSBRKP) followed by driver errors in dmesg.

Detection Strategies

Audit running kernel versions against the fixed commits published on kernel.org and flag hosts still on vulnerable branches.
Monitor syscall telemetry for processes issuing TCSBRK or TCSBRKP with unusually large duration arguments on TTYs that are prone to hangup.
Correlate hangup events (SIGHUP delivery, USB serial disconnect) with subsequent TTY driver warnings in kernel logs.

Monitoring Recommendations

Centralize dmesg and /var/log/kern.log into a SIEM and alert on TTY driver warnings tied to break handling.
Track package and kernel versions across the fleet so Linux kernels missing the backport are visible to operators.
Review audit logs for unprivileged processes that repeatedly open TTY devices and issue break ioctls, especially on multi-user hosts.

How to Mitigate CVE-2026-98751

Immediate Actions Required

Inventory Linux hosts and identify kernels that predate the fix commits linked in the references.
Apply the vendor kernel update that incorporates the TTY break-on-hangup fix and reboot affected systems.
Prioritize systems that expose hot-pluggable serial devices or allow unprivileged users to open PTYs.

Patch Information

The fix changes the TTY layer so that TCSBRK and TCSBRKP abort on hangup rather than re-entering break_ctl(). The upstream patches are available in the following kernel.org commits: Kernel Commit 3bc82999, Kernel Commit 6c9c9367, Kernel Commit 845a2737, Kernel Commit 94af6cd8, and Kernel Commit c8ccd3b2. Apply distribution kernels that incorporate these backports.

Workarounds

Restrict access to hot-pluggable serial devices by tightening udev rules and group membership on /dev/tty* nodes.
Limit unprivileged use of pseudo-terminals and serial devices through container, namespace, or seccomp policies that block TCSBRK and TCSBRKP.
Where feasible, avoid holding long break-duration ioctls on devices that may be physically removed during operation.

bash

# Verify the running kernel version and compare to distribution advisories
uname -r

# Example: block TCSBRK (0x5409) and TCSBRKP (0x5425) ioctls using a seccomp
# policy in your container runtime or systemd unit, e.g.:
# SystemCallFilter=~ioctl