CVE-2026-53385

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

A KASAN null-ptr-deref was observed in vcs_notifier():

BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130

Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}

The issue is a race condition in vcs_write(). When the console_lock is

temporarily dropped (to copy data from userspace), the vc_data pointer

obtained from vcs_vc() may become stale. After re-acquiring the lock,

vcs_vc() is called again to re-validate the pointer. If the vc has been

deallocated in the meantime, vcs_vc() returns NULL, and the while loop

breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)

is still called with the now-NULL vc pointer, leading to a null pointer

dereference in the notifier chain (vcs_notifier dereferences param->vc).

Fix this by adding a NULL check for vc before calling vcs_scr_updated().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References