0.0
NA
CVE-2026-53385
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
Description

In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().

INFO

Published Date :

July 19, 2026, 12:16 p.m.

Last Modified :

July 19, 2026, 12:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-53385 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Add a NULL check for vc before calling vcs_scr_updated to prevent null pointer dereference.
  • Add NULL check for vc before calling vcs_scr_updated.
  • Ensure vc pointer is valid before further operations.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53385 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53385 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53385 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-53385 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '11dddfbb7a4e62489b01074d6c04d9d1b42e4047', 'lessThan': '43a6281790273c1b0a9ab76609ff0245b968f1e6', 'versionType': 'git'}, {'status': 'affected', 'version': 'e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67', 'lessThan': 'b6bbb85cf45bf0b070e741997fe0af3a772c5ad5', 'versionType': 'git'}, {'status': 'affected', 'version': '3338d0b9acde770ee588eead5cac32c25e7048fc', 'lessThan': 'ff4806202749a51938236214adc0281481a57366', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '8232fca738011ca2ec865b46ec721d1796dc0580', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '73049768ad57145acd337102c5aa3c788e6642c8', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '7cc3dd79777f6ae4625ec37e84dd18a26dc88bde', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '74be188eb2dc1c99d63986167b9a67d415fe7326', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': '09a43e81279b8da15526da09877134b8bcf618b0', 'versionType': 'git'}, {'status': 'affected', 'version': '8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357', 'lessThan': 'a287620312dc6dcb9a093417a0e589bf30fcf38a', 'versionType': 'git'}, {'status': 'affected', 'version': '934de9a9b659785fed3e820bc0c813a460c71fea', 'versionType': 'git'}, {'status': 'affected', 'version': '0deff678157333d775af190f84696336cdcccd6d', 'versionType': 'git'}, {'status': 'affected', 'version': 'a4e3c4c65ae8510e01352c9a4347e05c035b2ce2', 'versionType': 'git'}, {'status': 'affected', 'version': '1de42e7653d6714a7507ba6696151a1fa028c69f', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.181', 'lessThan': '5.10.260', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.113', 'lessThan': '5.15.211', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.30', 'lessThan': '6.1.177', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.14.327', 'lessThan': '4.15', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.284', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.244', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.3.4', 'lessThan': '6.4', 'versionType': 'semver'}], 'programFiles': ['drivers/tty/vt/vc_screen.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.14', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1.2', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tty/vt/vc_screen.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().
    Added Reference https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0
    Added Reference https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6
    Added Reference https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8
    Added Reference https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326
    Added Reference https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde
    Added Reference https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580
    Added Reference https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a
    Added Reference https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5
    Added Reference https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.