Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0013 3.2 —
AFFECTED
Product Versions Fixed
Linux 11dddfbb7a4e62489b01074d6c04d9d1b42e4047 – —
Linux 6.4 – 5.10.260
TIMELINE
Jun 9 Reserved by Linux
Jul 19 Published (CNA: Linux)
Aug 17 ENRICHED — CVE-2026-53385 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
A KASAN null-ptr-deref was observed in vcs_notifier():
BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}
The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).
Fix this by adding a NULL check for vc before calling vcs_scr_updated().
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 9, 2026 | Reserved | Reserved by Linux |
| July 19, 2026 | Published | Published (CNA: Linux) |
| August 17, 2026 | ENRICHED | ENRICHED — CVE-2026-53385 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 11dddfbb7a4e62489b01074d6c04d9d1b42e4047 | — |
| Linux | Linux | — | 6.4 | 5.10.260 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-53385 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.