CVE-2026-53385

CVE CVE-2026-53385EUVD EUVD-2026-45507Published 2026-07-19T11:59:32.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 5.10.181 <5.10.260; a4e3c4c65ae8510e01352c9a4347e05c035b2ce2; 6.3.4 <6.4; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <8232fca738011ca2ec865b46ec721d1796dc0580; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <74be188eb2dc1c99d63986167b9a67d415fe7326; 1de42e7653d6714a7507ba6696151a1fa028c69f; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <a287620312dc6dcb9a093417a0e589bf30fcf38a; patch: 6.18.37; patch: 6.6.144; 5.15.113 <5.15.211; patch: 5.15.211; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <73049768ad57145acd337102c5aa3c788e6642c8; 3338d0b9acde770ee588eead5cac32c25e7048fc <ff4806202749a51938236214adc0281481a57366; patch: 7.2-rc1; 6.1.30 <6.1.177; patch: 5.10.260; patch: 6.12.95; 4.14.327 <4.15; 5.4.244 <5.5; patch: 7.0.14; 4.19.284 <4.20; patch: 0; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <09a43e81279b8da15526da09877134b8bcf618b0; patch: 6.1.177; e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67 <b6bbb85cf45bf0b070e741997fe0af3a772c5ad5; 934de9a9b659785fed3e820bc0c813a460c71fea; 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 <7cc3dd79777f6ae4625ec37e84dd18a26dc88bde; 11dddfbb7a4e62489b01074d6c04d9d1b42e4047 <43a6281790273c1b0a9ab76609ff0245b968f1e6; 0deff678157333d775af190f84696336cdcccd6d; patch: 7.1.2; 6.4

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.