CVE-2026-98840: Linux kernel · vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in c073d01f6f5367c3a4f07efd507274ed0d03acd0 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:30 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in c073d01f6f5367c3a4f07efd507274ed0d03acd0, 1485a3dd97ab1af2605243cabe6b604546d46dd1, 233a2e190b12884d186027d0b86d43a48799b69c +10
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Description
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") sits after the 'if (ret)' block, so the copy-failure break path exits the loop without reloading vc. If the vc was kfree()'d via vc_port_destruct during the unlocked copy_from_user() window, the post-loop 'if (written && vc) vcs_scr_updated(vc)' is reached with a stale non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") only handles the NULL case, not this stale-non-NULL case; vcs_notifier() then reads param->vc->vc_num from freed memory: BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0 Read of size 2 at addr ffff888007149190 Call Trace: vcs_notifier+0x7c/0xd0 atomic_notifier_call_chain+0x70/0xa0 vcs_scr_updated+0x77/0xa0 vcs_write+0x71b/0x7e0 Allocated by task: vc_allocate -> con_install -> tty_open Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct) Move the reload to immediately after console_lock(), before 'if (ret)', so every break path below passes a fresh vc to the post-loop vcs_scr_updated().
References
- git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0 (opens in a new tab)
- git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1 (opens in a new tab)
- git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c (opens in a new tab)
- git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9 (opens in a new tab)
- git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530 (opens in a new tab)