Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Samuel Thibault]

Hello,

Weiming Shi, le sam. 29 août 2026 16:00:32 +0800, a ecrit:
> One correction: this is triggerable without root. I reproduced it on
> Debian 13.6 with espeakup enabled, from a tty1 session with:
> 
>   uid=1000(tester) gid=1000(tester)
>   CapEff: 0000000000000000
> 
> The process called VT_ACTIVATE on its controlling tty, which is allowed
> without CAP_SYS_TTY_CONFIG. Switching to VT8, which had no getty in this
> setup, left vc->port.tty NULL. Pressing the Speakup paste key

Pressing the speakup paste key either requires simulating it as root, or
pressing it physically, who in the speakup security model is rather
trusted.

Samuel