vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2023-53747
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-12-08 02:15:50 UTC
Updated2026-08-04 10:19:19 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK> Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001360000 probability, percentile 0.034620000 (date 2026-08-05)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 934de9a9b659785fed3e820bc0c813a460c71fea git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 0deff678157333d775af190f84696336cdcccd6d git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff a4e3c4c65ae8510e01352c9a4347e05c035b2ce2 git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 11dddfbb7a4e62489b01074d6c04d9d1b42e4047 git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67 git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 3338d0b9acde770ee588eead5cac32c25e7048fc git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 1de42e7653d6714a7507ba6696151a1fa028c69f git Not specified
CNA Linux Linux affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 git Not specified
CNA Linux Linux affected 2.6.38 Not specified
CNA Linux Linux unaffected 2.6.38 semver Not specified
CNA Linux Linux unaffected 4.14.327 4.14.* semver Not specified
CNA Linux Linux unaffected 4.19.284 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.244 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.181 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.113 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.30 6.1.* semver Not specified
CNA Linux Linux unaffected 6.3.4 6.3.* semver Not specified
CNA Linux Linux unaffected 6.4 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1de42e7653d6714a7507ba6696151a1fa028c69f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3338d0b9acde770ee588eead5cac32c25e7048fc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0deff678157333d775af190f84696336cdcccd6d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/11dddfbb7a4e62489b01074d6c04d9d1b42e4047 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/934de9a9b659785fed3e820bc0c813a460c71fea 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a4e3c4c65ae8510e01352c9a4347e05c035b2ce2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report