CVE-2023-54198

tty: fix out-of-bounds access in tty_driver_lookup_tty()

State: Published
Severity: 7.8 High
Published: Dec 30, 2025
Updated: Oct 15, 2026
Reserved: Dec 30, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: fix out-of-bounds access in tty_driver_lookup_tty()

When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number.

To reproduce:

qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270"

This crashes with:

[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 3df6f492f500a16c231f07ccc6f6ed1302caddf9Affected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before b79109d6470aaae7062998353e3a19449055829dAffected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 953a4a352a0c185460ae1449e4c6e6658e55fdfcAffected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 84ea44dc3e4ecb2632586238014bf6722aa5843bAffected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before f9d9d25ad1f0d060eaf297a2f7f03b5855a45561Affected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 765566110eb0da3cf60198b0165ecceeaafa6444Affected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before fcfeaa570f7a5c2d5f4f14931909531ff18b7fdeAffected 99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before db4df8e9d79e7d37732c1a1b560958e8dadfefa1Affected
LinuxLinux	2.6.28Affected before 2.6.28Not affected 4.14.308 through 4.14.Not affected 4.19.276 through 4.19.Not affected 5.4.235 through 5.4.Not affected 5.10.173 through 5.10.Not affected 5.15.100 through 5.15.Not affected 6.1.18 through 6.1.Not affected 6.2.5 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 3df6f492f500a16c231f07ccc6f6ed1302caddf9Affected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before b79109d6470aaae7062998353e3a19449055829dAffected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 953a4a352a0c185460ae1449e4c6e6658e55fdfcAffected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 84ea44dc3e4ecb2632586238014bf6722aa5843bAffected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before f9d9d25ad1f0d060eaf297a2f7f03b5855a45561Affected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before 765566110eb0da3cf60198b0165ecceeaafa6444Affected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before fcfeaa570f7a5c2d5f4f14931909531ff18b7fdeAffected
99f1fe189daf8e99a847e420567e49dd7ee2aae7 to before db4df8e9d79e7d37732c1a1b560958e8dadfefa1Affected

LinuxLinux

2.6.28Affected
before 2.6.28Not affected
4.14.308 through 4.14.*Not affected
4.19.276 through 4.19.*Not affected
5.4.235 through 5.4.*Not affected
5.10.173 through 5.10.*Not affected
5.15.100 through 5.15.*Not affected
6.1.18 through 6.1.*Not affected
6.2.5 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.