{"id":"CVE-2026-98840","kind":"vulnerability","aliases":["CVE-2026-98840"],"related":[],"title":"Linux kernel: vc_screen use-after-free in vcs_write() can read freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n  BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n  Read of size 2 at addr ffff888007149190\n  Call Trace:\n   vcs_notifier+0x7c/0xd0\n   atomic_notifier_call_chain+0x70/0xa0\n   vcs_scr_updated+0x77/0xa0\n   vcs_write+0x71b/0x7e0\n  Allocated by task: vc_allocate -> con_install -> tty_open\n  Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().","summary":"The Linux kernel's virtual console vcs_write() path can keep a stale pointer to a freed console structure when a copy fails during a race with a console being deallocated. The stale pointer is then read by the notifier, which can leak kernel memory or crash the system.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","virtual-console"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:38+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:10+00:00","updated_at":"2026-10-25T05:13:10+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:13:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: vc_screen use-after-free in vcs_write() can read freed memory","impact":"medium","summary":"The Linux kernel's virtual console vcs_write() path can keep a stale pointer to a freed console structure when a copy fails during a race with a console being deallocated. The stale pointer is then read by the notifier, which can leak kernel memory or crash the system.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","virtual-console"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel reads freed memory, possible crash or information leak","analyst_note":"Check the kernel.org stable commit for the fixed kernel versions and whether unprivileged users can open /dev/vcs devices.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000563,"input_tokens":3827,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':234C,247C,253C,258C,262C '-2026':17A,20A '-98840':18A,21A '2':239C '8fb9ea65c9d1':109C 'a287620312dc':186C 'add':106C 'addr':241C 'alloc':264C,268C 'atom':249C 'avoid':100C,123C 'block':130C 'break':136C,297C 'bug':224C 'call':243C,251C 'case':205C,212C 'chain':252C 'commit':108C,185C 'con':269C 'concurr':198C 'consol':28B,34B,46B,57B,290C 'copi':50B,134C,157C 'copy-failur':133C 'crash':75B 'cve':16A,19A 'd':149C 'data':117C 'dealloc':59B 'deref':193C 'destruct':153C,283C 'disalloc':280C 'everi':296C 'exit':138C 'fail':51B 'failur':135C 'ffff888007149190':242C 'fix':189C 'follow':83C 'free':8A,230C 'freed':14A,45B,222C,273C 'fresh':302C 'guard':183C 'handl':202C 'immedi':288C 'instal':270C 'ioctl':278C 'kasan':225C 'keep':39B 'kernel':2A,24B,31B,72B,81C 'kfree':148C,276C 'leak':71B 'linux':1A,23B,30B,80C 'linux-kernel':22B 'load':113C 'lock':291C 'loop':140C,164C,308C 'memori':15A,73B,223C 'move':284C 'non':178C,210C 'non-nul':177C 'notifi':68B,196C,214C,233C,246C,250C 'null':179C,191C,204C,211C 'null-ptr-deref':190C 'num':220C 'open':272C 'param':217C 'pass':300C 'path':37B,137C,298C 'pointer':42B,62B,92C,118C 'port':152C,282C 'post':163C,307C 'post-loop':162C,306C 'ptr':192C 'race':54B 'reach':173C 'read':13A,65B,216C,236C 'reload':90C,103C,112C,142C,286C 'resolv':87C 'ret':95C,129C,294C 'runtim':25B 'scr':169C,256C,310C 'screen':4A,89C,111C,188C 'sit':125C 'size':238C 'slab':227C 'slab-use-after-fre':226C 'stale':41B,61B,176C,209C 'stale-non-nul':208C 'struct':115C 'structur':47B 'system':77B 'task':266C,275C 'trace':244C 'tti':271C 'uaf':101C,124C 'unlock':156C 'updat':170C,257C,311C 'use':6A,228C 'use-after-fre':5A 'user':159C 'vc':3A,88C,91C,105C,110C,116C,143C,146C,151C,167C,171C,180C,182C,187C,218C,219C,267C,281C,303C 'vcs':10A,35B,97C,120C,168C,195C,199C,213C,232C,245C,255C,260C,309C 'via':150C 'virtual':27B,33B 'virtual-consol':26B 'vt':277C,279C 'vulner':84C 'window':160C 'without':141C 'write':11A,36B,98C,121C,200C,261C 'written':166C 'x70/0xa0':254C 'x71b/0x7e0':263C 'x77/0xa0':259C 'x7c/0xd0':235C,248C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98840","severity":null,"published_at":"2026-10-18T16:17:38+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}