Use After Free Vulnerability in Linux Kernel's VC Screen Functionality

CVE-2026-98840

What is CVE-2026-98840?

A vulnerability in the Linux kernel's vc_screen functionality presents a Use After Free risk due to improper handling of the vc pointer in the vcs_write() function. When the 'vc' pointer is not correctly reloaded after a break in execution flow, it can lead to accessing freed memory. This oversight allows the vcs_notifier() function to read stale data from a deallocated vc structure, potentially leading to undefined behavior or system instability. A fix has been implemented to ensure that the vc pointer is reloaded immediately after acquiring the console lock, thus guaranteeing its validity across all execution paths.

References