CVE-2026-98840 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") sits after the 'if (ret)' block, so the copy-failure break path exits the loop without reloading vc. If the vc was kfree()'d via vc_port_destruct during the unlocked copy_from_user() window, the post-loop 'if (written && vc) vcs_scr_updated(vc)' is reached with a stale non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") only handles the NULL case, not this stale-non-NULL case; vcs_notifier() then reads param->vc->vc_num from freed memory:
BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0 Read of size 2 at addr ffff888007149190 Call Trace: vcs_notifier+0x7c/0xd0 atomic_notifier_call_chain+0x70/0xa0 vcs_scr_updated+0x77/0xa0 vcs_write+0x71b/0x7e0 Allocated by task: vc_allocate -> con_install -> tty_open Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)
Move the reload to immediately after console_lock(), before 'if (ret)', so every break path below passes a fresh vc to the post-loop vcs_scr_updated().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a use-after-free vulnerability within the virtual console subsystem, specifically in the vcs_write function. This flaw arises from an incorrect placement of a pointer reload operation intended to mitigate race conditions during user-space data copying operations. The original fix attempted to address this by reloading the vc_data structure pointer after checking for copy failures, but it was positioned incorrectly relative to control flow breaks within the loop. Consequently, when a copy_from_user call fails and triggers an early exit from the processing loop via a break statement, the code bypasses the reload logic entirely. This leaves the local variable holding the console data structure pointer in a stale state that may reference memory already freed by concurrent operations.
The core technical issue involves a race condition between writing to the virtual console device and other kernel threads managing terminal allocation states. During the window where copy_from_user is executed without holding certain locks, another task can invoke vt_ioctl with the VT_DISALLOCATE command. This ioctl triggers vc_port_destruct which subsequently calls kfree on the underlying struct vc_data object. If this deallocation occurs while vcs_write is processing data and then encounters a write error that causes it to break out of its loop prematurely, the subsequent code path attempts to access the now-freed memory through the stale pointer. The existing guard condition checking for null pointers fails to catch this scenario because the pointer remains non-null but points to invalid heap memory rather than being set to NULL by proper cleanup routines.
This vulnerability allows for a slab-use-after-free exploitation vector that can lead to kernel crashes or potentially arbitrary code execution depending on how an attacker manipulates memory allocation patterns around the freed object. The impact is significant as it affects system stability and security integrity of the virtual console interface which is commonly used in server environments and embedded systems. Attackers with local access could exploit this race condition by repeatedly triggering write errors while simultaneously allocating and freeing terminal structures to increase the probability of hitting the vulnerable window.
The remediation involves restructuring the control flow within vcs_write to ensure that any exit path from the processing loop results in a valid, freshly loaded pointer before proceeding to post-loop notifications. By moving the reload operation immediately after acquiring console_lock and before checking for copy failures, every potential break statement now passes through code that updates the vc pointer with current state information. This ensures that even if an error occurs during data transfer, the subsequent call to vcs_scr_updated receives a valid reference or NULL rather than a dangling pointer to freed memory.
From a standards perspective this vulnerability maps to CWE-416 which describes use-after-free errors where software continues to use a pointer after it has been freed leading to unpredictable behavior. In terms of attack patterns the scenario aligns with ATT&CK technique T1059 related to command and script interpretation through local exploitation mechanisms that leverage race conditions in kernel subsystems. The fix demonstrates proper synchronization practices by ensuring atomicity between lock acquisition, data validation, and pointer updates within critical sections protecting shared kernel structures.
System administrators should apply the corresponding kernel patch as soon as possible to mitigate this risk. For environments where virtual consoles are actively used for system management or debugging purposes, timely update of the operating system is essential to prevent potential denial-of-service conditions arising from kernel panics caused by these memory corruption events. Monitoring logs for KASAN slab-use-after-free messages can help identify systems that may have been targeted during the window before patching was applied.