{"id":"CVE-2026-98840","summary":"vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param-\u003evc-\u003evc_num from freed memory:\n\n  BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n  Read of size 2 at addr ffff888007149190\n  Call Trace:\n   vcs_notifier+0x7c/0xd0\n   atomic_notifier_call_chain+0x70/0xa0\n   vcs_scr_updated+0x77/0xa0\n   vcs_write+0x71b/0x7e0\n  Allocated by task: vc_allocate -\u003e con_install -\u003e tty_open\n  Freed by task: kfree \u003c- vt_ioctl (VT_DISALLOCATE -\u003e vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().","modified":"2026-10-19T02:47:32.235442253Z","published":"2026-10-18T15:50:14.029Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98840.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530"},{"type":"WEB","url":"https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98840.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98840"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"73049768ad57145acd337102c5aa3c788e6642c8"},{"fixed":"1485a3dd97ab1af2605243cabe6b604546d46dd1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7cc3dd79777f6ae4625ec37e84dd18a26dc88bde"},{"fixed":"233a2e190b12884d186027d0b86d43a48799b69c"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a287620312dc6dcb9a093417a0e589bf30fcf38a"},{"fixed":"9dfcadc5e003fb250dd471db90144bd5366140e9"},{"fixed":"226bd5603371cd9f6642cbb9e9a677f445de3530"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.95"},{"fixed":"6.12.113"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.37"},{"fixed":"6.18.56"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.260"},{"fixed":"5.11"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.211"},{"fixed":"5.16"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.177"},{"fixed":"6.2"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.144"},{"fixed":"6.7"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7.0.14"},{"fixed":"7.1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7.1.2"},{"fixed":"7.2"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"43a6281790273c1b0a9ab76609ff0245b968f1e6"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b6bbb85cf45bf0b070e741997fe0af3a772c5ad5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ff4806202749a51938236214adc0281481a57366"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8232fca738011ca2ec865b46ec721d1796dc0580"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"74be188eb2dc1c99d63986167b9a67d415fe7326"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"09a43e81279b8da15526da09877134b8bcf618b0"}]}],"versions":["v6.12.112","v6.12.111","v6.12.110","v6.12.109","v6.12.108","v6.12.107","v6.12.106","v6.12.105","v6.12.104","v6.12.103","v6.12.102","v6.12.101","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.12.96","v6.12.95","v6.18.55","v6.18.54","v6.18.53","v6.18.52","v6.18.51","v6.18.50","v6.18.49","v6.18.48","v6.18.47","v6.18.46","v6.18.45","v6.18.44","v6.18.43","v6.18.42","v6.18.41","v6.18.40","v6.18.39","v6.18.38","v6.18.37","v5.10.272","v5.10.271","v5.10.270","v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.15.223","v5.15.222","v5.15.221","v5.15.220","v5.15.219","v5.15.218","v5.15.217","v5.15.216","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v6.1.190","v6.1.189","v6.1.188","v6.1.187","v6.1.186","v6.1.185","v6.1.184","v6.1.183","v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.1.177","v6.6.159","v6.6.158","v6.6.157","v6.6.156","v6.6.155","v6.6.154","v6.6.153","v6.6.152","v6.6.151","v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v7.0.14","v7.1.13","v7.1.12","v7.1.11","v7.1.10","v7.1.9","v7.1.8","v7.1.7","v7.1.6","v7.1.5","v7.1.4","v7.1.3","v7.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98840.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98840.json"}}],"schema_version":"1.9.0"}