Unsigned Underflow and Out-of-Bounds Read Vulnerability in Linux Kernel

CVE-2026-98839

What is CVE-2026-98839?

A vulnerability exists in the Linux kernel within the paste_selection() function, where improper handling of buffer lengths can lead to an unsigned underflow condition. This occurs during the loop that copies data into the line discipline receive buffer, potentially resulting in an out-of-bounds read. Specifically, if the selection mutex is released while the buffer is filled, a concurrent operation can modify the buffer size, causing the subsequent read operation to exceed allocated memory limits, which may lead to memory corruption and exploitation. The issue has been addressed by ensuring the loop terminates when the pasted count matches or exceeds the updated buffer length.

References