CVE-2023-53747

vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF

State: Published
Severity: 7.8 High
Published: Dec 8, 2025
Updated: Oct 15, 2026
Reserved: Dec 8, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF

After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called.

Syzkaller reported a UAF in vcs_size().

BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119

Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK>

Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ...

Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ...

The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00)

The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 934de9a9b659785fed3e820bc0c813a460c71feaAffected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 0deff678157333d775af190f84696336cdcccd6dAffected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before a4e3c4c65ae8510e01352c9a4347e05c035b2ce2Affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 11dddfbb7a4e62489b01074d6c04d9d1b42e4047Affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67Affected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 3338d0b9acde770ee588eead5cac32c25e7048fcAffected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 1de42e7653d6714a7507ba6696151a1fa028c69fAffected ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357Affected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 4.14.327 through 4.14.Not affected 4.19.284 through 4.19.Not affected 5.4.244 through 5.4.Not affected 5.10.181 through 5.10.Not affected 5.15.113 through 5.15.Not affected 6.1.30 through 6.1.Not affected 6.3.4 through 6.3.*Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 934de9a9b659785fed3e820bc0c813a460c71feaAffected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 0deff678157333d775af190f84696336cdcccd6dAffected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before a4e3c4c65ae8510e01352c9a4347e05c035b2ce2Affected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 11dddfbb7a4e62489b01074d6c04d9d1b42e4047Affected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67Affected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 3338d0b9acde770ee588eead5cac32c25e7048fcAffected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 1de42e7653d6714a7507ba6696151a1fa028c69fAffected
ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff to before 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357Affected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
4.14.327 through 4.14.*Not affected
4.19.284 through 4.19.*Not affected
5.4.244 through 5.4.*Not affected
5.10.181 through 5.10.*Not affected
5.15.113 through 5.15.*Not affected
6.1.30 through 6.1.*Not affected
6.3.4 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.