{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-98840", "modified": "2026-10-19T04:30:01Z", "upstream": [ "CVE-2026-98840" ], "published": "2026-10-18T15:54:51Z", "summary": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -> con_install -> tty_open\n Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.96-1+rpt1", "1:6.12.109-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.96+rpt-rpi-2712", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v6", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7l", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-2712", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v6", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v7", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v7l", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v8", "binary_version": "1:6.12.109-1+rpt1" }, { "binary_name": "linux-image-6.12.109+rpt-rpi-v8-rt", "binary_version": "1:6.12.109-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.96-1+rpt1": { "linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481", "upstream_version": "6.12.96", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.113" }, "1:6.12.109-1+rpt1": { "linux_commit": "7d1826930811232688a50c99c540fbb137aed081", "upstream_version": "6.12.109", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.113" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.56" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.56" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98840" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-18T15:54:51Z" } }