In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF The… (CVE-2026-98840)

The vulnerability in the Linux kernel's vc_screen subsystem involves a use-after-free condition in the vcs_write() function. The reload of the vc pointer was originally placed after an 'if (ret)' block, which allowed a stale non-NULL vc pointer to be used if the vc was freed during an unlocked copy_from_user() window. This stale pointer was then dereferenced in vcs_notifier(), causing a slab-use-after-free error detected by KASAN. The fix moves the reload of the vc pointer to immediately after console_lock(), before the 'if (ret)' check, ensuring that all code paths use a fresh vc pointer and preventing use-after-free.

This vulnerability can lead to use-after-free memory access in the kernel, potentially causing kernel crashes or memory corruption. There is no indication of remote exploitability or privilege escalation in the provided data. The impact is limited to kernel stability and memory safety.

A fix has been implemented in the Linux kernel by moving the reload of the vc pointer to before the 'if (ret)' check in vcs_write(). Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.