{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98840", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.373Z", "datePublished": "2026-10-18T15:50:14.029Z", "dateUpdated": "2026-10-30T12:40:08.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:08.759Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -> con_install -> tty_open\n Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/vc_screen.c"], "versions": [{"version": "43a6281790273c1b0a9ab76609ff0245b968f1e6", "lessThan": "cbc05413d3694193494b2374b56bae801ac41fec", "status": "affected", "versionType": "git"}, {"version": "b6bbb85cf45bf0b070e741997fe0af3a772c5ad5", "lessThan": "942742000a0288d4ca60c448894aabacd48004d5", "status": "affected", "versionType": "git"}, {"version": "ff4806202749a51938236214adc0281481a57366", "lessThan": "c9f56d4b29792a62b17f2051ba93fd3b40a479ec", "status": "affected", "versionType": "git"}, {"version": "8232fca738011ca2ec865b46ec721d1796dc0580", "lessThan": "c073d01f6f5367c3a4f07efd507274ed0d03acd0", "status": "affected", "versionType": "git"}, {"version": "73049768ad57145acd337102c5aa3c788e6642c8", "lessThan": "1485a3dd97ab1af2605243cabe6b604546d46dd1", "status": "affected", "versionType": "git"}, {"version": "7cc3dd79777f6ae4625ec37e84dd18a26dc88bde", "lessThan": "233a2e190b12884d186027d0b86d43a48799b69c", "status": "affected", "versionType": "git"}, {"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a", "lessThan": "9dfcadc5e003fb250dd471db90144bd5366140e9", "status": "affected", "versionType": "git"}, {"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a", "lessThan": "226bd5603371cd9f6642cbb9e9a677f445de3530", "status": "affected", "versionType": "git"}, {"version": "74be188eb2dc1c99d63986167b9a67d415fe7326", "status": "affected", "versionType": "git"}, {"version": "09a43e81279b8da15526da09877134b8bcf618b0", "status": "affected", "versionType": "git"}, {"version": "5.10.260", "lessThan": "5.10.273", "status": "affected", "versionType": "semver"}, {"version": "5.15.211", "lessThan": "5.15.224", "status": "affected", "versionType": "semver"}, {"version": "6.1.177", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.144", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.95", "lessThan": "6.12.113", "status": "affected", "versionType": "semver"}, {"version": "6.18.37", "lessThan": "6.18.56", "status": "affected", "versionType": "semver"}, {"version": "7.0.14", "lessThan": "7.1", "status": "affected", "versionType": "semver"}, {"version": "7.1.2", "lessThan": "7.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/vc_screen.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.260", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.211", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.177", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.144", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.95", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.37", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cbc05413d3694193494b2374b56bae801ac41fec"}, {"url": "https://git.kernel.org/stable/c/942742000a0288d4ca60c448894aabacd48004d5"}, {"url": "https://git.kernel.org/stable/c/c9f56d4b29792a62b17f2051ba93fd3b40a479ec"}, {"url": "https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0"}, {"url": "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1"}, {"url": "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"}, {"url": "https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9"}, {"url": "https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530"}], "title": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/vt/vc_screen.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cbc05413d3694193494b2374b56bae801ac41fec", "status": "affected", "version": "43a6281790273c1b0a9ab76609ff0245b968f1e6", "versionType": "git"}, {"lessThan": "942742000a0288d4ca60c448894aabacd48004d5", "status": "affected", "version": "b6bbb85cf45bf0b070e741997fe0af3a772c5ad5", "versionType": "git"}, {"lessThan": "c9f56d4b29792a62b17f2051ba93fd3b40a479ec", "status": "affected", "version": "ff4806202749a51938236214adc0281481a57366", "versionType": "git"}, {"lessThan": "c073d01f6f5367c3a4f07efd507274ed0d03acd0", "status": "affected", "version": "8232fca738011ca2ec865b46ec721d1796dc0580", "versionType": "git"}, {"lessThan": "1485a3dd97ab1af2605243cabe6b604546d46dd1", "status": "affected", "version": "73049768ad57145acd337102c5aa3c788e6642c8", "versionType": "git"}, {"lessThan": "233a2e190b12884d186027d0b86d43a48799b69c", "status": "affected", "version": "7cc3dd79777f6ae4625ec37e84dd18a26dc88bde", "versionType": "git"}, {"lessThan": "9dfcadc5e003fb250dd471db90144bd5366140e9", "status": "affected", "version": "a287620312dc6dcb9a093417a0e589bf30fcf38a", "versionType": "git"}, {"lessThan": "226bd5603371cd9f6642cbb9e9a677f445de3530", "status": "affected", "version": "a287620312dc6dcb9a093417a0e589bf30fcf38a", "versionType": "git"}, {"status": "affected", "version": "74be188eb2dc1c99d63986167b9a67d415fe7326", "versionType": "git"}, {"status": "affected", "version": "09a43e81279b8da15526da09877134b8bcf618b0", "versionType": "git"}, {"lessThan": "5.10.273", "status": "affected", "version": "5.10.260", "versionType": "semver"}, {"lessThan": "5.15.224", "status": "affected", "version": "5.15.211", "versionType": "semver"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.177", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.144", "versionType": "semver"}, {"lessThan": "6.12.113", "status": "affected", "version": "6.12.95", "versionType": "semver"}, {"lessThan": "6.18.56", "status": "affected", "version": "6.18.37", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.14", "versionType": "semver"}, {"lessThan": "7.2", "status": "affected", "version": "7.1.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/vt/vc_screen.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -> con_install -> tty_open\n Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated()."}], "id": "CVE-2026-98840", "lastModified": "2026-10-30T13:21:30.193", "metrics": {}, "published": "2026-10-18T16:17:38.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/942742000a0288d4ca60c448894aabacd48004d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c073d01f6f5367c3a4f07efd507274ed0d03acd0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9f56d4b29792a62b17f2051ba93fd3b40a479ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cbc05413d3694193494b2374b56bae801ac41fec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in virtual console screen driver", "id": "2555216", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555216"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\nBUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\nRead of size 2 at addr ffff888007149190\nCall Trace:\nvcs_notifier+0x7c/0xd0\natomic_notifier_call_chain+0x70/0xa0\nvcs_scr_updated+0x77/0xa0\nvcs_write+0x71b/0x7e0\nAllocated by task: vc_allocate -> con_install -> tty_open\nFreed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().", "A flaw was found in the Linux kernel's virtual console screen driver. A race condition between virtual console write operations and console deallocation can cause the kernel to access previously freed memory, resulting in a use-after-free vulnerability. A local user could exploit this flaw to cause a Denial of Service (DoS) by crashing the system or potentially corrupt kernel memory."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98840", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:50:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98840\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98840\nhttps://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1\nhttps://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530\nhttps://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c\nhttps://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9\nhttps://kernelcve.org/list/?q=CVE-2026-98840"], "statement": "A race in vcs_write can leave a stale non-NULL vc_data pointer when copy_from_user fails after the virtual console was freed during the unlocked window. The stale pointer is later passed through vcs_scr_updated to vcs_notifier, which reads vc_num from freed slab memory and produces a confirmed use-after-free read. For the CVSS the PR:L value is used because triggering requires a local user or process with access to the relevant vcs and virtual terminal interfaces, while the exact device permissions depend on the system configuration. AC:H is used because successful triggering depends on winning a race between vcs_write and virtual console deallocation. The issue is not network reachable. Impact is at least a local denial of service through a kernel warning, Oops, or crash. Limited confidentiality or integrity impact is retained only in the paranoid score because slab reuse may affect the stale read, but no controlled write or demonstrated privilege escalation primitive is present.", "threat_severity": "Moderate"}