CVE-2026-98840
- Source
- https://cve.org/CVERecord?id=CVE-2026-98840
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98840.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98840
- Downstream
- Published
- 2026-10-18T15:50:14Z
- Modified
- 2026-10-19T02:47:32Z
- Summary
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") sits after the 'if (ret)' block, so the copy-failure break path exits the loop without reloading vc. If the vc was kfree()'d via vc_port_destruct during the unlocked copy_from_user() window, the post-loop 'if (written && vc) vcs_scr_updated(vc)' is reached with a stale non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") only handles the NULL case, not this stale-non-NULL case; vcs_notifier() then reads param->vc->vc_num from freed memory:
BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0 Read of size 2 at addr ffff888007149190 Call Trace: vcs_notifier+0x7c/0xd0 atomic_notifier_call_chain+0x70/0xa0 vcs_scr_updated+0x77/0xa0 vcs_write+0x71b/0x7e0 Allocated by task: vc_allocate -> con_install -> tty_open Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)
Move the reload to immediately after console_lock(), before 'if (ret)', so every break path below passes a fresh vc to the post-loop vcs_scr_updated().
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98840.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1
- https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530
- https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c
- https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98840.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98840
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced73049768ad57145acd337102c5aa3c788e6642c8Fixed1485a3dd97ab1af2605243cabe6b604546d46dd1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7cc3dd79777f6ae4625ec37e84dd18a26dc88bdeFixed233a2e190b12884d186027d0b86d43a48799b69c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda287620312dc6dcb9a093417a0e589bf30fcf38aFixed9dfcadc5e003fb250dd471db90144bd5366140e9Fixed226bd5603371cd9f6642cbb9e9a677f445de3530
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.95Fixed6.12.113
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.37Fixed6.18.56
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.10.260Fixed5.11
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.211Fixed5.16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.177Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.144Fixed6.7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.0.14Fixed7.1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.1.2Fixed7.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced43a6281790273c1b0a9ab76609ff0245b968f1e6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb6bbb85cf45bf0b070e741997fe0af3a772c5ad5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedff4806202749a51938236214adc0281481a57366
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8232fca738011ca2ec865b46ec721d1796dc0580
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced74be188eb2dc1c99d63986167b9a67d415fe7326
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced09a43e81279b8da15526da09877134b8bcf618b0