In the Linux kernel, the following vulnerability has been resolved:
vcscreen: fix null-ptr-deref in vcsnotifier() during concurrent vcs_write
A KASAN null-ptr-deref was observed in vcs_notifier():
BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities, arguments: {}
The issue is a race condition in vcswrite(). When the consolelock is temporarily dropped (to copy data from userspace), the vcdata pointer obtained from vcsvc() may become stale. After re-acquiring the lock, vcsvc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcsvc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcsscrupdated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc).
Fix this by adding a NULL check for vc before calling vcsscrupdated().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53385.json",
"cna_assigner": "Linux"
}