CVE-2026-74675 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel's virtual terminal subsystem contains a race condition vulnerability within the kbd_keycode function that can lead to use-after-free errors and potential system instability. This flaw arises from improper handling of reference counting for terminal device structures during keyboard input processing. Specifically, the kbd_keycode function accesses the tty pointer stored in vc->port.tty without first acquiring a proper reference count on that object. In concurrent execution environments where multiple threads or interrupt handlers may access shared kernel data structures simultaneously, this lack of synchronization creates a window of vulnerability.
The core technical issue involves a race condition between keyboard input processing and terminal shutdown operations. When kbd_keycode reads the tty pointer from vc->port.tty, it assumes the referenced object will remain valid for the duration of its operation. However, the con_shutdown function can clear this same port.tty field under a different lock mechanism during terminal device teardown procedures. Without holding an explicit reference count on the tty structure, there is no guarantee that the memory backing the tty object remains allocated and accessible when kbd_keycode attempts to dereference it later in its execution path.
This race condition falls squarely within CWE-416, which describes use-after-free vulnerabilities where a program continues to use memory after it has been freed or invalidated. The vulnerability manifests when con_shutdown releases its reference to the tty structure while kbd_keycode still holds only an unchecked pointer to that same object. If the kernel's memory management subsystem reclaims and repurposes this memory before kbd_keycode completes its operations, subsequent dereferences will access invalid or potentially attacker-controlled memory regions.
The operational impact of this vulnerability is significant for system stability and security integrity. Successful exploitation could result in kernel panics due to null pointer dereferences when the tty structure has been completely freed. Alternatively, if an attacker can control what gets allocated into the reclaimed memory space before kbd_keycode accesses it, they might achieve arbitrary code execution with kernel privileges. The vulnerability affects systems where keyboard input processing overlaps temporally with terminal device shutdown operations, which commonly occurs during session termination, console switching, or virtual machine migration scenarios involving multiple concurrent terminal sessions.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability enables privilege escalation techniques categorized under Defense Evasion and Privilege Escalation tactics. Attackers could leverage the race condition to bypass security controls by triggering kernel crashes that disable logging mechanisms or execute malicious code before system integrity checks can respond. The vulnerability is particularly dangerous because it does not require special privileges to trigger initially, as keyboard input processing occurs at relatively low privilege levels within normal user sessions.
The resolution implemented in this patch addresses the root cause through proper reference counting mechanics using tty_port_tty_get and tty_kref_put functions. By acquiring a reference count before accessing vc->port.tty, the kernel ensures that the tty structure remains valid throughout kbd_keycode execution regardless of concurrent shutdown operations elsewhere in the subsystem. The corresponding release via tty_kref_put guarantees balanced reference management without introducing memory leaks or dangling pointers. This approach aligns with established best practices for handling shared kernel objects where multiple code paths may access the same data structures concurrently under different locking regimes.
System administrators and developers should ensure their Linux kernels are updated to include this fix, particularly in environments running long-lived terminal sessions or virtualization platforms that frequently create and destroy console devices. The vulnerability highlights the importance of rigorous reference counting discipline in kernel development, where failure to properly manage object lifetimes can lead to severe security consequences despite seemingly innocuous code paths.