CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
In the Linux kernel, the following vulnerability has been resolved:
vcscreen: fix null-ptr-deref in vcsnotifier() during concurrent vcswrite
A KASAN null-ptr-deref was observed in vcsnotifier():
BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities, arguments: {}
The issue is a race condition in vcswrite(). When the consolelock is temporarily dropped (to copy data from userspace), the vcdata pointer obtained from vcsvc() may become stale. After re-acquiring the lock, vcsvc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcsvc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcsscrupdated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcsnotifier dereferences param->vc).
Fix this by adding a NULL check for vc before calling vcsscrupdated().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
Fix the kernel race by adding a NULL check for vc before calling vcs_scr_updated() in vcs_notifier(), and ensure vcs_vc() is called again after the loop to re-validate the pointer before vcs_notifier dereferences param->vc.
Linux kernel (vcs notifier / vcs_write) Add NULL checks and re-validate vc pointer (vcs_vc) before notifier dereference = implemented
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53385?
CVE-2026-53385 has a medium severity rating of 5.5 according to CVSS 3.1.
How do I fix CVE-2026-53385?
To fix CVE-2026-53385, update the Linux kernel to the latest version that includes the patch addressing the null pointer dereference.
What type of vulnerability is CVE-2026-53385?
CVE-2026-53385 is classified as a race condition and a null pointer dereference issue in the Linux kernel.
What happens if CVE-2026-53385 is exploited?
If CVE-2026-53385 is exploited, it may lead to a null pointer dereference resulting in a kernel crash.
When was CVE-2026-53385 published?
CVE-2026-53385 was published on July 19, 2026.