Executive brief
A use-after-free vulnerability in the Linux kernel's virtual console screen driver (vc_screen) allows an attacker to read freed memory by manipulating console device file operations. An exploit could crash the system, leak sensitive kernel memory, or potentially achieve code execution, affecting the stability and security of any system running a vulnerable kernel version.
Technical details
The vulnerability is a use-after-free (UAF) in the vcs_write() function within drivers/tty/vt/vc_screen.c. After console_unlock() is called, the vc_data structure can be freed by vc_port_destruct() in a race condition. The vcs_write() function then reuses the freed pointer without reloading it after re-acquiring the console lock, leading to a UAF when vcs_size() dereferences the stale pointer. The vulnerability is reachable through write operations to /dev/vcs device files without requiring special privileges. The fix involves reloading the vc_data pointer within the while loop after console_lock() to ensure validity before use. KASAN detected this as a slab-use-after-free read of size 4.
Affected products
- Linux Linux kernel Multiple versions (prior to fix)
Timeline
- 2025-12-08: disclosed: CVE-2023-53747 published on NVD
- 2025-12-08: exploited: Reported as discovered by Syzkaller fuzzer