5.5

CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Analyzed
AliasesUBUNTU-CVE-2026-53385DEBIAN-CVE-2026-53385
Published 19-07-2026Last modified 17-08-2026

Vulnerability summary

CVE-2026-53385 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.13%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 32
MGASA-2026-0312OPENSUSE-SU-2026:11339-1OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu165 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 11dddfbb7a4e62489b01074d6c04d9d1b42e4047, < 43a6281790273c1b0a9ab76609ff0245b968f1e6 | ≥ e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67, < b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 | ≥ 3338d0b9acde770ee588eead5cac32c25e7048fc, < ff4806202749a51938236214adc0281481a57366 | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < 8232fca738011ca2ec865b46ec721d1796dc0580 | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < 73049768ad57145acd337102c5aa3c788e6642c8 | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < 7cc3dd79777f6ae4625ec37e84dd18a26dc88bde | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < 74be188eb2dc1c99d63986167b9a67d415fe7326 | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < 09a43e81279b8da15526da09877134b8bcf618b0 | ≥ 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357, < a287620312dc6dcb9a093417a0e589bf30fcf38a | 934de9a9b659785fed3e820bc0c813a460c71fea | 0deff678157333d775af190f84696336cdcccd6d | a4e3c4c65ae8510e01352c9a4347e05c035b2ce2 | 1de42e7653d6714a7507ba6696151a1fa028c69f | ≥ 5.10.181, < 5.10.260 | ≥ 5.15.113, < 5.15.211 | ≥ 6.1.30, < 6.1.177 | ≥ 4.14.327, < 4.15 | ≥ 4.19.284, < 4.20 | ≥ 5.4.244, < 5.5 | ≥ 6.3.4, < 6.4 | 6.4
  • linux_kernelEOL≥ 4.14.327, < 4.15 | ≥ 4.19.284, < 4.20 | ≥ 5.4.244, < 5.5 | ≥ 5.10.181, < 5.10.260 | ≥ 5.15.113, < 5.15.211 | ≥ 6.1.30, < 6.1.177 | ≥ 6.3.4, < 6.4 | ≥ 6.4.1, < 6.6.144 | ≥ 6.7, < 6.12.95 | ≥ 6.13, < 6.18.37 | ≥ 6.19, < 7.0.14 | ≥ 7.1, < 7.1.2 | 6.4 | 6.4:rc3 | 6.4:rc4 | 6.4:rc5 | 6.4:rc6 | 6.4:rc7
Debian1 product
  • linux< 6.1.177-1 | < 6.12.95-1 | < 7.0.14-1

3 vendors · 168 products

References

32 links
Show all 32 references