CVE-2026-98839 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
In paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into tty_ldisc_receive_buf() and increments pasted += count.
Because the selection mutex (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted.
When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.
Fix this by terminating the loop when pasted >= vc_sel.buf_len.
Kernel stack trace (Linux 7.3.0-rc3): ================================================================== BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650 Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65 Workqueue: events_unbound flush_to_ldisc Call Trace: <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200 __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ==================================================================
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the Linux kernel involves a critical race condition within the virtual terminal selection and paste mechanism, specifically located in the paste_selection function. This flaw allows for an unsigned integer underflow that subsequently leads to a slab-out-of-bounds read operation. The issue arises from the interaction between the long-running copy loop used for pasting selected text and concurrent modifications to the selection buffer by other kernel processes or user-space applications via ioctl calls.
The core technical flaw lies in how paste_selection handles data transfer when the terminal line discipline receive buffer becomes full. During normal operation, this function iterates through the selected text buffer, copying chunks of data into tty_ldisc_receive_buf and incrementing a counter named pasted to track progress. Crucially, if the destination buffer fills up, the function drops the selection mutex vc_sel.lock to sleep on tty->write_wait until space becomes available. This release of the lock creates a window where other threads can modify the state protected by that same mutex.
A concurrent TIOCLINUX ioctl call with the command TIOCL_SETSEL allows user-space applications to change the current text selection in the virtual terminal. When this occurs while paste_selection is sleeping, it can replace vc_sel.buffer with a new buffer and significantly reduce vc_sel.buf_len. Because the pasted counter retains its value from before the sleep, upon resumption, the calculation min_t(unsigned int, vc_sel.buf_len - pasted) results in an unsigned underflow. Since both operands are unsigned integers, subtracting a larger number from a smaller one wraps around to a very large positive integer rather than becoming negative.
This erroneous length value is then passed to tty_ldisc_receive_buf as the size of data to copy. Consequently, the kernel attempts to read up to 4094 bytes or more beyond the bounds of the newly allocated vc_sel.buffer. This out-of-bounds memory access triggers a Kernel Address Sanitizer KASAN report indicating a slab-out-of-bounds read. The vulnerability is classified under CWE-190 Integer Overflow Wrap-Around and CWE-125 Out-of-bounds Read, reflecting both the arithmetic error and its direct consequence on memory safety.
From an operational perspective, this vulnerability poses significant risks to system stability and potentially security. While the immediate impact described in kernel logs manifests as a crash or panic due to invalid memory access, out-of-bounds reads can also lead information disclosure by leaking sensitive data from adjacent kernel memory regions into user-space processes via the terminal output stream. The attack vector involves local privilege escalation potential if an unprivileged user can trigger this race condition repeatedly to cause denial of service against system resources or potentially extract kernel memory contents.
The remediation for this issue involves modifying paste_selection to enforce a strict boundary check before performing any copy operations after waking from sleep. Specifically, the loop must terminate immediately when pasted is greater than or equal to vc_sel.buf_len. This ensures that even if the buffer length shrinks due to concurrent modifications, the function will not attempt to access memory beyond the current valid selection range. Developers should also consider holding the lock during critical sections of data transfer where possible, although this may impact performance on slow terminals.
Mitigation strategies for system administrators include applying kernel updates that contain this patch as soon as they are available from distribution vendors. For systems unable to update immediately, restricting access to TIOCLINUX ioctl commands through security modules like SELinux or AppArmor can reduce the attack surface by preventing unprivileged users from altering selection buffers while paste operations are in progress. Additionally, monitoring for kernel panics related to tty line discipline processing may help detect exploitation attempts of this race condition in real-time environments.