NULL pointer dereference in Linux kernel - CVE-2026-53385

Vulnerability identifier: #VU138879

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53385

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference caused by a race condition in vcs_notifier() in drivers/tty/vt/vc_screen.c when handling concurrent vcs_write operations. A local user can trigger concurrent write activity to cause a denial of service.

The issue occurs after the console lock is temporarily dropped and re-acquired, allowing the vc_data pointer to become stale before notifier processing.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-azure (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1011.11, 7.0.0-1014.14
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1

• https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0
• https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6
• https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8
• https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326
• https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde
• https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580
• https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a
• https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5
• https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366

• NULL pointer dereference in Linux kernel tty vt driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-7.0