CVE-2026-53385
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
Description
In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
July 19, 2026, 12:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-53385
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Add NULL check for vc before calling vcs_scr_updated.
- Ensure vc pointer is valid before further operations.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53385.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53385 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53385
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53385 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53385 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '11dddfbb7a4e62489b01074d6c04d9d1b42e4047', 'lessThan': '43a6281790273c1b0a9ab76609ff0245b968f1e6', 'versionType': 'git'}, {'status': 'affected', 'version': 'e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67', 'lessThan': 'b6bbb85cf45bf0b070e741997fe0af3a772c5ad5', 'versionType': 'git'}, {'status': 'affected', 'version': '3338d0b9acde770ee588eead5cac32c25e7048fc', 'lessThan': 'ff4806202749a51938236214adc0281481a57366', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '8232fca738011ca2ec865b46ec721d1796dc0580', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '73049768ad57145acd337102c5aa3c788e6642c8', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '7cc3dd79777f6ae4625ec37e84dd18a26dc88bde', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '74be188eb2dc1c99d63986167b9a67d415fe7326', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '09a43e81279b8da15526da09877134b8bcf618b0', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': 'a287620312dc6dcb9a093417a0e589bf30fcf38a', 'versionType': 'git'}, {'status': 'affected', 'version': '934de9a9b659785fed3e820bc0c813a460c71fea', 'versionType': 'git'}, {'status': 'affected', 'version': '0deff678157333d775af190f84696336cdcccd6d', 'versionType': 'git'}, {'status': 'affected', 'version': 'a4e3c4c65ae8510e01352c9a4347e05c035b2ce2', 'versionType': 'git'}, {'status': 'affected', 'version': '1de42e7653d6714a7507ba6696151a1fa028c69f', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.181', 'lessThan': '5.10.260', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.113', 'lessThan': '5.15.211', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.30', 'lessThan': '6.1.177', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.14.327', 'lessThan': '4.15', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.284', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.244', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.3.4', 'lessThan': '6.4', 'versionType': 'semver'}], 'programFiles': ['drivers/tty/vt/vc_screen.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.14', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1.2', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tty/vt/vc_screen.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). Added Reference https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0 Added Reference https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6 Added Reference https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8 Added Reference https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326 Added Reference https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde Added Reference https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580 Added Reference https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a Added Reference https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 Added Reference https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366