Jakob Koschel

A issue in the Linux kernel has been identified where a stale list iterator could be dereferenced after a loop, potentially leading to out-of-bounds or undefined values being loaded. This could result in unsafe comparisons, making it difficult to determine if a specific element was found. The problem arises when 'cur->page' is dereferenced and its value is used for comparison, as it may match the value of 'page' by chance or intention, even if the correct element was not found.

The issue is related to the `vt ioctl` function, specifically the `vt setactivate` call, where the `array index nospec` mechanism fails to properly sanitize an out-of-bounds value, leading to a transient integer underflow. The `vsa.console` value should be decreased first and then sanitized with `array index nospec` to prevent this issue.