{"id":"CVE-2026-98840","aliases":[],"cve":{"records":[{"id":"CVE-2026-98840","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.373Z","published":"2026-10-18T15:50:14.029Z","modified":"2026-10-30T12:40:08.759Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:40:08.759Z"}],"references":[{"url":"https://git.kernel.org/stable/c/cbc05413d3694193494b2374b56bae801ac41fec","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/942742000a0288d4ca60c448894aabacd48004d5","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/c9f56d4b29792a62b17f2051ba93fd3b40a479ec","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.260","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.211","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.177","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.144","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.95","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.37","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.2"}]}]}]}],"prioritization":[]},"title":"vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n  BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n  Read of size 2 at addr ffff888007149190\n  Call Trace:\n   vcs_notifier+0x7c/0xd0\n   atomic_notifier_call_chain+0x70/0xa0\n   vcs_scr_updated+0x77/0xa0\n   vcs_write+0x71b/0x7e0\n  Allocated by task: vc_allocate -> con_install -> tty_open\n  Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().","score":null,"severity":"unknown","published":"2026-10-18T15:50:14.029Z","modified":"2026-10-30T12:40:08.759Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"43a6281790273c1b0a9ab76609ff0245b968f1e6","status":"affected","lessThan":"cbc05413d3694193494b2374b56bae801ac41fec","versionType":"git"},{"version":"b6bbb85cf45bf0b070e741997fe0af3a772c5ad5","status":"affected","lessThan":"942742000a0288d4ca60c448894aabacd48004d5","versionType":"git"},{"version":"ff4806202749a51938236214adc0281481a57366","status":"affected","lessThan":"c9f56d4b29792a62b17f2051ba93fd3b40a479ec","versionType":"git"},{"version":"8232fca738011ca2ec865b46ec721d1796dc0580","status":"affected","lessThan":"c073d01f6f5367c3a4f07efd507274ed0d03acd0","versionType":"git"},{"version":"73049768ad57145acd337102c5aa3c788e6642c8","status":"affected","lessThan":"1485a3dd97ab1af2605243cabe6b604546d46dd1","versionType":"git"},{"version":"7cc3dd79777f6ae4625ec37e84dd18a26dc88bde","status":"affected","lessThan":"233a2e190b12884d186027d0b86d43a48799b69c","versionType":"git"},{"version":"a287620312dc6dcb9a093417a0e589bf30fcf38a","status":"affected","lessThan":"9dfcadc5e003fb250dd471db90144bd5366140e9","versionType":"git"},{"version":"a287620312dc6dcb9a093417a0e589bf30fcf38a","status":"affected","lessThan":"226bd5603371cd9f6642cbb9e9a677f445de3530","versionType":"git"},{"version":"74be188eb2dc1c99d63986167b9a67d415fe7326","status":"affected","versionType":"git"},{"version":"09a43e81279b8da15526da09877134b8bcf618b0","status":"affected","versionType":"git"},{"version":"5.10.260","status":"affected","lessThan":"5.10.273","versionType":"semver"},{"version":"5.15.211","status":"affected","lessThan":"5.15.224","versionType":"semver"},{"version":"6.1.177","status":"affected","lessThan":"6.1.191","versionType":"semver"},{"version":"6.6.144","status":"affected","lessThan":"6.6.160","versionType":"semver"},{"version":"6.12.95","status":"affected","lessThan":"6.12.113","versionType":"semver"},{"version":"6.18.37","status":"affected","lessThan":"6.18.56","versionType":"semver"},{"version":"7.0.14","status":"affected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.2","status":"affected","lessThan":"7.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98840"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.2","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98840"}],"remediation":[],"references":["https://git.kernel.org/stable/c/cbc05413d3694193494b2374b56bae801ac41fec","https://git.kernel.org/stable/c/942742000a0288d4ca60c448894aabacd48004d5","https://git.kernel.org/stable/c/c9f56d4b29792a62b17f2051ba93fd3b40a479ec","https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0","https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1","https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c","https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9","https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530"],"sources":[{"name":"CVE","id":"CVE-2026-98840","modified":"2026-10-30T12:40:08.759Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98840"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:09:42.567Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:40:32.870Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel has a use-after-free vulnerability in vc_screen, affecting versions including 5.10.260 to 5.10.273, 5.15.211 to 5.15.224, 6.1.177 to 6.1.191, 6.6.144 to 6.6.160, 6.12.95 to 6.12.113, 6.18.37 to 6.18.56, 7.0.14, 7.1.2, and 7.2. The vulnerability occurs when the 'vc' pointer is not reloaded before the 'if (ret)' block in vcs_write(), allowing a stale non-NULL 'vc' to be used. This can lead to a read from freed memory in vcs_notifier().","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T14:47:24.365Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98840"}]}}