CVE-2026-98840
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.17 %mayor que el 6 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
vc_screen: recargar el puntero vc antes de if (ret) en vcs_write() para evitar UAF
La recarga de 'vc' añadida por el commit 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") se sitúa después del bloque 'if (ret)', de modo que la ruta de interrupción por fallo de copia sale del bucle sin recargar vc.
Leer descripción completaMostrar menos
Si vc fue liberado con kfree() mediante vc_port_destruct durante la ventana sin bloqueo de copy_from_user(), la comprobación posterior al bucle 'if (written && vc) vcs_scr_updated(vc)' se alcanza con un vc obsoleto pero no nulo. La guarda '&& vc' del commit a287620312dc ("vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") solo cubre el caso nulo, no este caso de vc obsoleto no nulo; vcs_notifier() entonces lee param->vc->vc_num desde memoria liberada:
Mover la recarga a justo después de console_lock(), antes de 'if (ret)', de modo que cada ruta de interrupción posterior pase un vc actualizado a la llamada vcs_scr_updated() posterior al bucle.
Detalles técnicos trazas, registros y código del informe original
BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0 Read of size 2 at addr ffff888007149190 Call Trace: vcs_notifier+0x7c/0xd0 atomic_notifier_call_chain+0x70/0xa0 vcs_scr_updated+0x77/0xa0 vcs_write+0x71b/0x7e0 Allocated by task: vc_allocate -> con_install -> tty_open Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98840",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "73049768ad57145acd337102c5aa3c788e6642c8",
"lessThan": "1485a3dd97ab1af2605243cabe6b604546d46dd1",
"versionType": "git"
},
{
"status": "affected",
"version": "7cc3dd79777f6ae4625ec37e84dd18a26dc88bde",
"lessThan": "233a2e190b12884d186027d0b86d43a48799b69c",
"versionType": "git"
},
{
"status": "affected",
"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a",
"lessThan": "9dfcadc5e003fb250dd471db90144bd5366140e9",
"versionType": "git"
},
{
"status": "affected",
"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a",
"lessThan": "226bd5603371cd9f6642cbb9e9a677f445de3530",
"versionType": "git"
},
{
"status": "affected",
"version": "43a6281790273c1b0a9ab76609ff0245b968f1e6",
"versionType": "git"
},
{
"status": "affected",
"version": "b6bbb85cf45bf0b070e741997fe0af3a772c5ad5",
"versionType": "git"
},
{
"status": "affected",
"version": "ff4806202749a51938236214adc0281481a57366",
"versionType": "git"
},
{
"status": "affected",
"version": "8232fca738011ca2ec865b46ec721d1796dc0580",
"versionType": "git"
},
{
"status": "affected",
"version": "74be188eb2dc1c99d63986167b9a67d415fe7326",
"versionType": "git"
},
{
"status": "affected",
"version": "09a43e81279b8da15526da09877134b8bcf618b0",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.95",
"lessThan": "6.12.113",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.37",
"lessThan": "6.18.56",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.260",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.211",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.177",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.144",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.14",
"lessThan": "7.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.2",
"lessThan": "7.2",
"versionType": "semver"
}
],
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:38.293",
"references": [
{
"url": "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()'d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n'if (written && vc) vcs_scr_updated(vc)' is reached with a stale\nnon-NULL vc. The '&& vc' guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param->vc->vc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -> con_install -> tty_open\n Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before 'if (ret)',\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated()."
}
],
"lastModified": "2026-10-19T10:19:48.077",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}