CVE-2026-98840

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load

of struct vc_data pointer in vcs_write() to avoid UAF") sits after the

'if (ret)' block, so the copy-failure break path exits the loop without

reloading vc. If the vc was kfree()'d via vc_port_destruct during the

unlocked copy_from_user() window, the post-loop

'if (written && vc) vcs_scr_updated(vc)' is reached with a stale

non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen:

fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") only

handles the NULL case, not this stale-non-NULL case; vcs_notifier() then

reads param->vc->vc_num from freed memory:

BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0

Read of size 2 at addr ffff888007149190

Call Trace:

vcs_notifier+0x7c/0xd0

atomic_notifier_call_chain+0x70/0xa0

vcs_scr_updated

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References