CVE-2026-53385
Received Received - Intake

Null-ptr-deref in Linux Kernel vcs_write

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53385
EUVD
EUVD-2026-45507

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null-pointer dereference vulnerability in the Linux kernel's vc_screen driver. It occurs during concurrent vcs_write operations when a race condition causes a stale vc_data pointer to be used. After a loop breaks due to a NULL vc pointer, vcs_scr_updated() is still called with this NULL pointer, leading to a crash in the notifier chain.

Detection Guidance

This vulnerability is specific to the Linux kernel and may not have direct network detection methods. Monitor kernel logs for KASAN null-ptr-deref errors related to vcs_notifier or vcs_write. Check for crashes or hangs in virtual console operations.

Impact Analysis

This vulnerability can cause system crashes (kernel panic) when specific console operations are performed concurrently. It may lead to denial-of-service conditions, requiring a reboot to restore functionality. Data corruption is unlikely but possible if the system becomes unstable.

Compliance Impact

This vulnerability is a null-pointer dereference in the Linux kernel's vc_screen driver, caused by a race condition during concurrent vcs_write operations. It does not directly relate to data privacy, access control, or audit logging requirements in GDPR or HIPAA. The impact is limited to kernel stability and potential denial-of-service conditions.

Mitigation Strategies

Apply the Linux kernel patch that fixes the null-ptr-deref in vcs_notifier(). Update to a kernel version containing the fix. If immediate patching is not possible, restrict access to virtual console operations or monitor for related crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart