CVE-2026-53385: Linux Kernel Race Condition Vulnerability

CVE-2026-53385 Overview

CVE-2026-53385 is a race condition in the Linux kernel's vc_screen virtual console driver that causes a null pointer dereference in vcs_notifier(). The flaw was detected by Kernel Address Sanitizer (KASAN) during concurrent vcs_write() operations. When console_lock is temporarily released to copy data from userspace, the vc_data pointer returned by vcs_vc() can become stale. If the virtual console is deallocated during that window, subsequent code paths dereference a NULL vc pointer inside the notifier chain. The upstream fix adds a NULL check before calling vcs_scr_updated().

Critical Impact
Local attackers with the ability to trigger concurrent writes to /dev/vcs* devices can cause a kernel null pointer dereference, leading to a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel (mainline and stable branches prior to the fix commits)
Distributions shipping vulnerable versions of the vc_screen driver
Systems exposing virtual console character devices (/dev/vcs, /dev/vcsa, /dev/vcsu)

Discovery Timeline

2026-07-19 - CVE-2026-53385 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-53385

Vulnerability Analysis

The defect resides in the vcs_write() path of drivers/tty/vt/vc_screen.c. During writes, the driver must copy data from a userspace buffer, which cannot be done while holding console_lock. The code releases the lock, performs the copy, then re-acquires the lock and calls vcs_vc() to re-validate the virtual console pointer. This lock-drop window creates a Time-of-Check Time-of-Use (TOCTOU) condition against concurrent teardown of the virtual console. The write loop correctly breaks when vcs_vc() returns NULL with written > 0, but execution then falls through to vcs_scr_updated(vc) with the NULL pointer. That call reaches vcs_notifier(), which dereferences param->vc, producing the observed KASAN report null-ptr-deref in vcs_notifier+0x98/0x130.

Root Cause

The root cause is missing NULL validation of the vc pointer after the write loop exits due to concurrent virtual console deallocation. The notifier chain assumes a valid vc_data structure and does not defend against a NULL parameter, so the stale pointer propagates directly into a dereference. This is a classic race condition [CWE-362] leading to a NULL pointer dereference [CWE-476].

Attack Vector

A local unprivileged process with access to a virtual console device can trigger the race by issuing concurrent write() syscalls against /dev/vcs* while another thread or process causes the underlying virtual console to be deallocated. Successful exploitation crashes the kernel through a NULL dereference in the notifier chain, producing a denial-of-service condition. The bug is not remotely reachable and requires local access to the affected device nodes.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commit messages linked below. See the Linux Kernel Commit ff48062 and related patches for the corrected code paths.

Detection Methods for CVE-2026-53385

Indicators of Compromise

Kernel oops or panic messages referencing vcs_notifier+0x98/0x130 in dmesg or /var/log/kern.log.
KASAN reports of null-ptr-deref originating from the vc_screen driver.
Unexpected crashes or hangs on systems where userspace processes repeatedly write to /dev/vcs* device nodes.

Detection Strategies

Monitor kernel ring buffer output for BUG: KASAN: null-ptr-deref signatures tied to vcs_notifier or vcs_scr_updated.
Compare running kernel versions against the fix commits (ff480620, 09a43e81, 43a62817, 73049768, 74be188e, 7cc3dd79, 8232fca7, a2876203, b6bbb85c) to identify unpatched hosts.
Audit which local accounts and services hold open file descriptors to /dev/vcs* and /dev/vcsa* nodes.

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on vcs_notifier crash signatures.
Track kernel package versions across the fleet via configuration management or vulnerability scanning tools.
Watch for repeated process restarts or unexpected reboots that correlate with virtual console activity.

How to Mitigate CVE-2026-53385

Immediate Actions Required

Apply the vendor-provided kernel update that includes the upstream NULL-check patch for vcs_write().
Restrict permissions on /dev/vcs* and /dev/vcsa* device nodes to trusted users only.
Reboot systems after patching to load the corrected kernel image.

Patch Information

The issue is resolved upstream by adding a NULL check for vc before calling vcs_scr_updated() in drivers/tty/vt/vc_screen.c. The fix is present in multiple stable branches through the following commits: Linux Kernel Commit 09a43e8, Linux Kernel Commit 43a6281, Linux Kernel Commit 7304976, Linux Kernel Commit 74be188, Linux Kernel Commit 7cc3dd7, Linux Kernel Commit 8232fca, Linux Kernel Commit a2876203, Linux Kernel Commit b6bbb85, and Linux Kernel Commit ff48062. Consume the fix through your distribution's kernel package updates.

Workarounds

Tighten file mode and ownership on virtual console character devices to prevent untrusted local users from opening them.
Where virtual console access is not required, disable or unload components that expose /dev/vcs* nodes.
Use mandatory access control (SELinux, AppArmor) policies to constrain which processes may write to virtual console devices.

bash

# Restrict access to virtual console screen devices to root only
chown root:root /dev/vcs* /dev/vcsa* /dev/vcsu*
chmod 600 /dev/vcs* /dev/vcsa* /dev/vcsu*

# Verify the running kernel includes the fix
uname -r
rpm -q kernel   # RHEL/Fedora
dpkg -l | grep linux-image   # Debian/Ubuntu