CVE-2020-8649: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the Linux kernel through version 5.5.2, specifically in the vgacon_invert_region function located in drivers/video/console/vgacon.c (CVE Details, Ubuntu Security). The vulnerability was identified and disclosed in February 2020.

The vulnerability exists in the VGA console driver's implementation of the invert video code. The issue specifically occurs in the vgacon_invert_region function when a local attacker attempts to resize the console, which can lead to a use-after-free condition (Red Hat CVE). The vulnerability has been assigned a CVSS v3 base score of 5.9 (Medium) (Ubuntu Security).

A local user permitted to access a virtual terminal (/dev/tty1 etc.) on a system using the vgacon driver could exploit this vulnerability to cause a denial of service (crash or memory corruption) or potentially escalate privileges (Debian Security).

The vulnerability has been fixed in multiple Linux distributions through security updates. For example, Debian fixed this in version 4.9.210-1+deb9u1 for Stretch and 3.16.84-1 for Jessie (Debian Security). OpenSUSE Leap 15.1 addressed it in kernel version 4.12.14-lp151.28.44.1 (OpenSUSE Security).