High 7.8Published Dec 30, 2025

CVE-2023-54198tty: fix out-of-bounds access in tty_driver_lookup_tty()

Updated under an hour ago (Oct 27, 2026, 9:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number. To reproduce: qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270" This crashes with: [ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	99f1fe189daf8e99a847e420567e49dd7ee2aae7 builds before 3df6f492f500a16c231f07ccc6f6ed1302caddf9; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before b79109d6470aaae7062998353e3a19449055829d; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before 953a4a352a0c185460ae1449e4c6e6658e55fdfc; 99f1fe189daf8e99a847e420567e49dd7ee2aae7 builds before 84ea44dc3e4ecb2632586238014bf6722aa5843b; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before f9d9d25ad1f0d060eaf297a2f7f03b5855a45561; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before 765566110eb0da3cf60198b0165ecceeaafa6444; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before fcfeaa570f7a5c2d5f4f14931909531ff18b7fde; from 99f1fe189daf8e99a847e420567e49dd7ee2aae7 before db4df8e9d79e7d37732c1a1b560958e8dadfefa1	CNA record

References

References

https://git.kernel.org/stable/c/3df6f492f500a16c231f07ccc6f6ed1302caddf9
https://git.kernel.org/stable/c/b79109d6470aaae7062998353e3a19449055829d
https://git.kernel.org/stable/c/953a4a352a0c185460ae1449e4c6e6658e55fdfc
https://git.kernel.org/stable/c/84ea44dc3e4ecb2632586238014bf6722aa5843b
https://git.kernel.org/stable/c/f9d9d25ad1f0d060eaf297a2f7f03b5855a45561
https://git.kernel.org/stable/c/765566110eb0da3cf60198b0165ecceeaafa6444
https://git.kernel.org/stable/c/fcfeaa570f7a5c2d5f4f14931909531ff18b7fde
https://git.kernel.org/stable/c/db4df8e9d79e7d37732c1a1b560958e8dadfefa1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.