Executive brief
The Linux kernel's virtual terminal keyboard handler contains a race condition that can cause a system crash or instability. When processing keyboard input, the code reads a TTY (text terminal) reference without proper locking, potentially reading a dangling pointer if the terminal is being shut down simultaneously. This could lead to kernel crashes when users press keys on systems with virtual terminals.
Technical details
The vulnerability is a use-after-free race condition in the kbd_keycode() function in drivers/tty/vt/keyboard.c. The function reads vc->port.tty without acquiring a reference count, while con_shutdown() can simultaneously clear this pointer under a different lock. An attacker or unprivileged user with access to trigger terminal shutdown and keyboard input concurrently could cause a NULL pointer dereference or use-after-free. The fix uses tty_port_tty_get() to safely acquire a reference and tty_kref_put() to release it, eliminating the race window. The patch applies to multiple stable kernel series from 2.6.11 through 7.2.
Affected products
- Linux Linux Kernel 2.6.11 through 7.2 (see git.kernel.org stable branches)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Fix committed upstream on 2026-07-31; stable backports applied 2026-08-19