CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved:

vc screen: reload vc pointer before if (ret) in vcs write() to avoid UAF

The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc screen: reload load of struct vc data pointer in vcs write() to avoid UAF") sits after the 'if (ret)' block, so the copy-failure break path exits the loop without reloading vc. If the vc was kfree()'d via vc port destruct during the unlocked copy from user() window, the post-loop 'if (written && vc) vcs scr updated(vc)' is reached with a stale non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc screen: fix null-ptr-deref in vcs notifier() during concurrent vcs write") only handles the NULL case, not this stale-non-NULL case; vcs notifier() then reads param->vc->vc num from freed memory:

BUG: KASAN: slab-use-after-free in vcs notifier+0x7c/0xd0 Read of size 2 at addr ffff888007149190 Call Trace: vcs notifier+0x7c/0xd0 atomic notifier call chain+0x70/0xa0 vcs scr updated+0x77/0xa0 vcs write+0x71b/0x7e0 Allocated by task: vc allocate -> con install -> tty open Freed by task: kfree <- vt ioctl (VT DISALLOCATE -> vc port destruct)

Move the reload to immediately after console lock(), before 'if (ret)', so every break path below passes a fresh vc to the post-loop vcs scr updated().