CVE-2026-53385

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Published Jul 19, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

A KASAN null-ptr-deref was observed in vcs_notifier():

BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}

The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).

Fix this by adding a NULL check for vc before calling vcs_scr_updated().

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11dddfbb7a4e62489b01074d6c04d9d1b42e4047`	affected	< 43a6281790273c1b0a9ab76609ff0245b968f1e6
`e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67`	affected	< b6bbb85cf45bf0b070e741997fe0af3a772c5ad5
`3338d0b9acde770ee588eead5cac32c25e7048fc`	affected	< ff4806202749a51938236214adc0281481a57366
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< 8232fca738011ca2ec865b46ec721d1796dc0580
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< 73049768ad57145acd337102c5aa3c788e6642c8
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< 7cc3dd79777f6ae4625ec37e84dd18a26dc88bde
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< 74be188eb2dc1c99d63986167b9a67d415fe7326
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< 09a43e81279b8da15526da09877134b8bcf618b0
`8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357`	affected	< a287620312dc6dcb9a093417a0e589bf30fcf38a
`934de9a9b659785fed3e820bc0c813a460c71fea`	affected	—
`0deff678157333d775af190f84696336cdcccd6d`	affected	—
`a4e3c4c65ae8510e01352c9a4347e05c035b2ce2`	affected	—
`1de42e7653d6714a7507ba6696151a1fa028c69f`	affected	—
`5.10.181`	affected	< 5.10.260
`5.15.113`	affected	< 5.15.211
`6.1.30`	affected	< 6.1.177
`4.14.327`	affected	< 4.15
`4.19.284`	affected	< 4.20
`5.4.244`	affected	< 5.5
`6.3.4`	affected	< 6.4

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1.2`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.4:-::::::
	cpe:2.3:o:linux:linux_kernel:6.4:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.4:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.4:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.4:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.4:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[11dddfbb7a4e62489b01074d6c04d9d1b42e4047,43a6281790273c1b0a9ab76609ff0245b968f1e6)`	affected	code_commit	—
`[e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67,b6bbb85cf45bf0b070e741997fe0af3a772c5ad5)`	affected	code_commit	—
`[3338d0b9acde770ee588eead5cac32c25e7048fc,ff4806202749a51938236214adc0281481a57366)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,8232fca738011ca2ec865b46ec721d1796dc0580)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,73049768ad57145acd337102c5aa3c788e6642c8)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,7cc3dd79777f6ae4625ec37e84dd18a26dc88bde)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,74be188eb2dc1c99d63986167b9a67d415fe7326)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,09a43e81279b8da15526da09877134b8bcf618b0)`	affected	code_commit	—
`[8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357,a287620312dc6dcb9a093417a0e589bf30fcf38a)`	affected	code_commit	—
`[934de9a9b659785fed3e820bc0c813a460c71fea,)]`	affected	code_commit	—
`[0deff678157333d775af190f84696336cdcccd6d,)]`	affected	code_commit	—
`[a4e3c4c65ae8510e01352c9a4347e05c035b2ce2,)]`	affected	code_commit	—
`[1de42e7653d6714a7507ba6696151a1fa028c69f,)]`	affected	code_commit	—
`[5.10.181,5.10.260)`	affected	semver	—
`[5.15.113,5.15.211)`	affected	semver	—
`[6.1.30,6.1.177)`	affected	semver	—
`[4.14.327,4.15)`	affected	generic	—
`[4.19.284,4.20)`	affected	generic	—
`[5.4.244,5.5)`	affected	generic	—
`[6.3.4,6.4)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.37,6.19.0)`	unaffected	semver	—
`[7.0.14,7.1.0)`	unaffected	semver	—
`[7.1.2,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.132% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0
https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6
https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8
https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326
https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde
https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580
https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a
https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5
https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366
https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-53385-95d4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53385
https://www.cve.org/CVERecord?id=CVE-2026-53385

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 21, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-53385-95d4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53385 https://www.cve.org/CVERecord?id=CVE-2026-53385
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Jul 19, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().
Title		vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0 https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6 https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8 https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326 https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580 https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366