NULL pointer dereference in Linux kernel - CVE-2026-53385
Published: July 21, 2026
Vulnerability identifier: #VU138879
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53385
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference caused by a race condition in vcs_notifier() in drivers/tty/vt/vc_screen.c when handling concurrent vcs_write operations. A local user can trigger concurrent write activity to cause a denial of service.
The issue occurs after the console lock is temporarily dropped and re-acquired, allowing the vc_data pointer to become stale before notifier processing.
Affected software
Linux kernel
How to mitigate CVE-2026-53385
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0
- https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6
- https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8
- https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326
- https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde
- https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580
- https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a
- https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5
- https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366