VulnerabilityPublished 19 Jul 2026Updated 6 Nov 2026

CVE-2026-53385: Linux kernel · vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ff4806202749a51938236214adc0281481a57366 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ff4806202749a51938236214adc0281481a57366, b6bbb85cf45bf0b070e741997fe0af3a772c5ad5, a287620312dc6dcb9a093417a0e589bf30fcf38a +13

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.181 <5.10.260 >=5.15.113 <5.15.211 >=6.1.30 <6.1.177 >=4.14.327 <4.15 >=4.19.284 <4.20 >=5.4.244 <5.5 >=6.3.4 <6.4	Fixed in ff4806202749a51938236214adc0281481a57366 b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 a287620312dc6dcb9a093417a0e589bf30fcf38a 73049768ad57145acd337102c5aa3c788e6642c8 8232fca738011ca2ec865b46ec721d1796dc0580 74be188eb2dc1c99d63986167b9a67d415fe7326 43a6281790273c1b0a9ab76609ff0245b968f1e6 09a43e81279b8da15526da09877134b8bcf618b0 7cc3dd79777f6ae4625ec37e84dd18a26dc88bde 6.4 6.1.177 5.15.211 5.10.260 5.5 4.20 4.15
LinuxLinux	Affected =6.4	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated().

References

Community reviews

Loading reviews…