EUVD-2026-64362
GHSA-pv3w-35gf-cp37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing to win, warranting AC:H; PR:L reflects required local user access; C/I/A:H reflects kernel use-after-free impact potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
AnalysisAI
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user session with at least low-privilege access (CVSS PR:L) on a system where virtual console (VT) support is active - standard on Linux desktops and most server configurations, but typically absent in containerized or minimal headless deployments where CONFIG_VT is disabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this High severity, but several signals moderate real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with standard account privileges simultaneously generates keyboard events through the virtual terminal subsystem while triggering or observing a concurrent virtual console shutdown, racing kbd_keycode() against con_shutdown(). If the race resolves favorably, the dangling or NULL tty pointer dereference produces a kernel use-after-free that can be shaped into a controlled memory corruption primitive for privilege escalation to root. … |
| Remediation | Upgrade to the patched Linux kernel version appropriate for your stable series: 5.10.265 or later, 5.15.216 or later, 6.1.183 or later, 6.6.152 or later, 6.12.104 or later, 6.18.45 or later, 7.1.9 or later, or 7.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit deployed systems to identify instances running Linux kernel versions 5.10 through 7.x across all infrastructure tiers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today