CVE-2026-74675

A flaw was found in the Linux kernel. A race condition exists in the kbd_keycode() function within the virtual terminal (vt) subsystem. This occurs when kbd_keycode() attempts to read a terminal (tty) reference without properly acquiring and holding it, while the con_shutdown() function can concurrently clear the same reference. This timing vulnerability can lead to a use-after-free condition, potentially causing system instability or a denial of service (DoS) for a local attacker.

A MODERATE severity race condition was found in the Linux kernel virtual terminal (vt) subsystem. The kbd_keycode() function reads the vc->port.tty pointer without acquiring a tty reference, while con_shutdown() can concurrently clear that same pointer under a different lock, leaving a window in which the tty pointer becomes stale. A local attacker with access to the console/virtual terminal path, who can combine keyboard input with virtual terminal tty state changes, could win this race and trigger a use-after-free, causing a kernel crash and local denial of service; the flaw is not network-reachable. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2, are affected. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. The fix is currently deferred for the affected streams rather than scheduled for an immediate update, so the race window remains; the residual risk is limited to the local availability impact (system crash/denial of service) that results from exploiting the tty object lifetime race. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the demonstrated impact is a local denial of service, whereas the upstream CVE record scores it 7.8 (IMPORTANT) by additionally crediting high confidentiality and integrity impact; Red Hat's assessment reflects that the practical consequence of this race is loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.