CVE-2026-98695

A flaw was found in the Linux kernel's USB serial subsystem. A local user could cause a Denial of Service (DoS) due to a race condition between input/output control (ioctl) operations and device disconnection. If a USB serial device is disconnected during an active operation, the driver may attempt to access released resources, triggering a null-pointer dereference and a system crash.

This vulnerability is rated as having a Moderate impact because it requires local access and precise race condition timing during the disconnection or hangup of a USB serial peripheral, resulting only in a system crash without compromising confidentiality or integrity. In typical Red Hat Enterprise Linux server deployments, physical USB serial hardware is rarely utilized, substantially constraining the attack surface. Furthermore, an attacker must have local access to the corresponding tty device node to invoke ioctl calls while the device is being detached.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.