In the Linux kernel, the following vulnerability has been resolved:
tty: fix out-of-bounds access in tty_driver_lookup_tty()
When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number.
To reproduce:
qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270"
This crashes with:
[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-livepatch-5.15.102-61.139Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.173-154.642Upgrade kernel-develUpgrade kernelUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.309-231.529 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-develUpgrade perfUpgrade kernel-livepatch-6.1.19-30.43Upgrade kernel-headers | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-hwe-5.4Upgrade linux-intel-iotgUpgrade linux-iotUpgrade linux-ibmUpgrade linux-azure-5.4Upgrade linux-nvidiaUpgrade linux-kvmUpgrade linux-riscv-5.15Upgrade linux-gcp-5.4Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-azure-fipsUpgrade linuxUpgrade linux-nvidia-tegra-igxUpgrade linux-ibm-5.4Upgrade linux-gcp-fipsUpgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-hwe-5.15Upgrade linux-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-realtimeUpgrade linux-oracle-5.4Upgrade linux-ibm-5.15Upgrade linux-gcp-5.15Upgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-aws-5.15Upgrade linux-raspiUpgrade linux-lowlatencyUpgrade linux-nvidia-tegra-5.15Upgrade linux-oracle-5.15Upgrade linux-azureUpgrade linux-lowlatency-hwe-5.15Upgrade linux-awsUpgrade linux-nvidia-tegraUpgrade linux-gke | Jan 6, 2026 | Jan 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub