In the Linux kernel, the following vulnerability has been resolved:

tty: fix out-of-bounds access in tty_driver_lookup_tty()

When specifying an invalid console= device like console=tty3270,
tty_driver_lookup_tty() returns the tty struct without checking
whether index is a valid number.

To reproduce:

qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \
-kernel ../linux-build-x86/arch/x86/boot/bzImage \
-append "console=ttyS0 console=tty3270"

This crashes with:

[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef
[ 0.771265] #PF: supervisor read access in kernel mode
[ 0.771773] #PF: error_code(0x0000) - not-present page
[ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI
[ 0.774878] RIP: 0010:tty_open+0x268/0x6f0
[ 0.784013] chrdev_open+0xbd/0x230
[ 0.784444] ? cdev_device_add+0x80/0x80
[ 0.784920] do_dentry_open+0x1e0/0x410
[ 0.785389] path_openat+0xca9/0x1050
[ 0.785813] do_filp_open+0xaa/0x150
[ 0.786240] file_open_name+0x133/0x1b0
[ 0.786746] filp_open+0x27/0x50
[ 0.787244] console_on_rootfs+0x14/0x4d
[ 0.787800] kernel_init_freeable+0x1e4/0x20d
[ 0.788383] ? rest_init+0xc0/0xc0
[ 0.788881] kernel_init+0x11/0x120
[ 0.789356] ret_from_fork+0x22/0x30

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< 3df6f492f500a16c231f07ccc6f6ed1302caddf9
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< b79109d6470aaae7062998353e3a19449055829d
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< 953a4a352a0c185460ae1449e4c6e6658e55fdfc
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< 84ea44dc3e4ecb2632586238014bf6722aa5843b
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< f9d9d25ad1f0d060eaf297a2f7f03b5855a45561
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< 765566110eb0da3cf60198b0165ecceeaafa6444
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< fcfeaa570f7a5c2d5f4f14931909531ff18b7fde
99f1fe189daf8e99a847e420567e49dd7ee2aae7 affected
< db4df8e9d79e7d37732c1a1b560958e8dadfefa1
Linux Linux affected
Version Status Constraints
2.6.28 affected
—
0 unaffected
< 2.6.28
4.14.308 unaffected
≤ 4.14.*
4.19.276 unaffected
≤ 4.19.*
5.4.235 unaffected
≤ 5.4.*
5.10.173 unaffected
≤ 5.10.*
5.15.100 unaffected
≤ 5.15.*
6.1.18 unaffected
≤ 6.1.*
6.2.5 unaffected
≤ 6.2.*
6.3 unaffected
≤ *

No data.

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3df6f492f500a16c231f07ccc6f6ed1302caddf9 cve-icon cve-icon
https://git.kernel.org/stable/c/765566110eb0da3cf60198b0165ecceeaafa6444 cve-icon cve-icon
https://git.kernel.org/stable/c/84ea44dc3e4ecb2632586238014bf6722aa5843b cve-icon cve-icon
https://git.kernel.org/stable/c/953a4a352a0c185460ae1449e4c6e6658e55fdfc cve-icon cve-icon
https://git.kernel.org/stable/c/b79109d6470aaae7062998353e3a19449055829d cve-icon cve-icon
https://git.kernel.org/stable/c/db4df8e9d79e7d37732c1a1b560958e8dadfefa1 cve-icon cve-icon
https://git.kernel.org/stable/c/f9d9d25ad1f0d060eaf297a2f7f03b5855a45561 cve-icon cve-icon
https://git.kernel.org/stable/c/fcfeaa570f7a5c2d5f4f14931909531ff18b7fde cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123029-CVE-2023-54198-1df4@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54198 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54198 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 30 Dec 2025 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number. To reproduce: qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270" This crashes with: [ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30
Title tty: fix out-of-bounds access in tty_driver_lookup_tty()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-05T11:36:50.292Z

Reserved: 2025-12-30T12:06:44.499Z

Link: CVE-2023-54198

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:16:07.877

Modified: 2025-12-31T20:43:05.160

Link: CVE-2023-54198

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2023-54198 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.