In the Linux kernel, the following vulnerability has been resolved:

tty: fix saved termios reset race

Resetting saved termios state on device registration is needed where a
minor number can be reused for an entirely different device and where
the old settings may prevent the port from even being opened (e.g. when
CLOCAL is not set).

Not all TTY drivers guarantee that the minor number is no longer in use
when registering devices however, something which can lead to a
use-after-free when closing a TTY (and saving its termios) races with
re-registration.

Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved
termios state is reset on registration and only set it for drivers that
make sure that the minor number is no longer in use.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
93857edd9829e144acb6c7e72d593f6e01aead66 affected < 1572d86bcf0bcb848d20fc5e5de7ed6963034c2b
93857edd9829e144acb6c7e72d593f6e01aead66 affected < 08bf919f041af9de372428bb0c938157ea144164
93857edd9829e144acb6c7e72d593f6e01aead66 affected < dcaf0251f847a45861e94c6617024a9455687d2f
93857edd9829e144acb6c7e72d593f6e01aead66 affected < 8df07fe93573e9e548d6645273e9bcb6eb74059e
Linux Linux affected
Version Status Constraints
4.12 affected —
0 unaffected < 4.12
6.12.113 unaffected ≤ 6.12.*
6.18.56 unaffected ≤ 6.18.*
7.2.10 unaffected ≤ 7.2.*
7.3-rc6 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08bf919f041af9de372428bb0c938157ea144164 cve-icon cve-icon
https://git.kernel.org/stable/c/1572d86bcf0bcb848d20fc5e5de7ed6963034c2b cve-icon cve-icon
https://git.kernel.org/stable/c/8df07fe93573e9e548d6645273e9bcb6eb74059e cve-icon cve-icon
https://git.kernel.org/stable/c/dcaf0251f847a45861e94c6617024a9455687d2f cve-icon cve-icon
History

Sun, 18 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use.
Title tty: fix saved termios reset race
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:47:35.167Z

Reserved: 2026-09-25T10:25:14.368Z

Link: CVE-2026-98750

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:28.767

Modified: 2026-10-18T16:17:28.767

Link: CVE-2026-98750

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T20:00:12Z

Weaknesses