GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74675 (GCVE-0-2026-74675)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Summary
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b84fd400f80adf4d1c88fbce50ae1cf2f8119e65 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 38400673c9bfb39cfc87539e1a072087e98f4e4f (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cab5a342f0589334046741006d8a280514f94235 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 38a0aa593ebc275aea6f79534d07f44e43768ce6 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3f6b1d3fcfc26dc3fc85262f753439df93b055b4 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b664592e9ba8c47c9e23408db7ba52eb9f946c8a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cc4a1a2ce0c58eafd477effb055863935260ddc1 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e25d47a526939ad44b75f778b8a7500562b84fc1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b84fd400f80adf4d1c88fbce50ae1cf2f8119e65",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38400673c9bfb39cfc87539e1a072087e98f4e4f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cab5a342f0589334046741006d8a280514f94235",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38a0aa593ebc275aea6f79534d07f44e43768ce6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3f6b1d3fcfc26dc3fc85262f753439df93b055b4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b664592e9ba8c47c9e23408db7ba52eb9f946c8a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cc4a1a2ce0c58eafd477effb055863935260ddc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e25d47a526939ad44b75f778b8a7500562b84fc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: stabilize tty reference in kbd_keycode with tty_port_tty_get\n\nkbd_keycode() reads vc-\u003eport.tty without acquiring a tty reference,\nracing against con_shutdown() which clears port.tty under a different\nlock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference\nfor the duration the tty pointer is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local virtual-console and input paths: kbd_keycode runs from the VT keyboard input handler on key/key-repeat events while con_shutdown runs during final close(2) on /dev/ttyN; there is no network, Bluetooth-only, or remote-protocol reachability to both sides of the race.\nAC:L - The attacker controls both race participants: one thread can loop open/close a console tty to drive release_tty/con_shutdown while another holds a key for repeat events (down==2) or injects EV_KEY via uinput, retrying until kbd_keycode uses a freed tty_struct.\nPR:L - No real-root capability is required; a console-logged-in user with normal DAC access to /dev/ttyN (typical tty-group membership) can close their VT tty and generate foreground key events, and vt_ioctl grants perm to the controlling-tty owner without CAP_SYS_TTY_CONFIG.\nUI:N - The attacker performs every step from its own console session\u2014opening/closing the VT tty and generating key or key-repeat input\u2014so no separate victim or administrator action is required.\nS:U - The slab use-after-free corrupts kernel heap memory within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After the tty is freed, kbd_keycode reads freed tty_struct fields (termios for L_ECHO and optionally tty-\u003eops via tty_chars_in_buffer), giving a use-after-free read primitive and enabling disclosure of kernel memory once the slab object is reclaimed.\nI:H - The path writes tty-\u003edriver_data on a freed tty_struct and may indirect-call through tty-\u003eops in tty_chars_in_buffer, enabling heap spray and control-flow hijack for arbitrary kernel modification or privilege escalation.\nA:H - Use-after-free on tty_struct reliably produces kernel oops or panic on illegal dereference through freed memory, and the open/close versus key-repeat race can be retriggered at will for repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:27.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b84fd400f80adf4d1c88fbce50ae1cf2f8119e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/38400673c9bfb39cfc87539e1a072087e98f4e4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cab5a342f0589334046741006d8a280514f94235"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a0aa593ebc275aea6f79534d07f44e43768ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6b1d3fcfc26dc3fc85262f753439df93b055b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b664592e9ba8c47c9e23408db7ba52eb9f946c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc4a1a2ce0c58eafd477effb055863935260ddc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e25d47a526939ad44b75f778b8a7500562b84fc1"
        }
      ],
      "title": "vt: stabilize tty reference in kbd_keycode with tty_port_tty_get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74675",
    "datePublished": "2026-08-22T15:32:44.493Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:27.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74675",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02939"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:51:16.000Z",
      "cve": "CVE-2026-74675",
      "id": "msrc_CVE-2026-74675",
      "initial_release_date": "2026-08-24T01:08:33.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "vt: stabilize tty reference in kbd_keycode with tty_port_tty_get",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74675.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74675\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:41.590\",\"lastModified\":\"2026-08-25T06:18:50.237\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvt: stabilize tty reference in kbd_keycode with tty_port_tty_get\\n\\nkbd_keycode() reads vc-\u003eport.tty without acquiring a tty reference,\\nracing against con_shutdown() which clears port.tty under a different\\nlock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference\\nfor the duration the tty pointer is needed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/vt/keyboard.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b84fd400f80adf4d1c88fbce50ae1cf2f8119e65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"38400673c9bfb39cfc87539e1a072087e98f4e4f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"cab5a342f0589334046741006d8a280514f94235\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"38a0aa593ebc275aea6f79534d07f44e43768ce6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3f6b1d3fcfc26dc3fc85262f753439df93b055b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b664592e9ba8c47c9e23408db7ba52eb9f946c8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"cc4a1a2ce0c58eafd477effb055863935260ddc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"e25d47a526939ad44b75f778b8a7500562b84fc1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/vt/keyboard.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38400673c9bfb39cfc87539e1a072087e98f4e4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/38a0aa593ebc275aea6f79534d07f44e43768ce6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f6b1d3fcfc26dc3fc85262f753439df93b055b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b664592e9ba8c47c9e23408db7ba52eb9f946c8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b84fd400f80adf4d1c88fbce50ae1cf2f8119e65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cab5a342f0589334046741006d8a280514f94235\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc4a1a2ce0c58eafd477effb055863935260ddc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e25d47a526939ad44b75f778b8a7500562b84fc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:54:07+00:00",
      "cve": "CVE-2026-74675",
      "id": "CVE-2026-74675",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74675.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:27:18Z",
      "cve": "CVE-2026-74675",
      "id": "CVE-2026-74675",
      "initial_release_date": "2026-08-23T00:04:47Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "88",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74675",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74675.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.