In the Linux kernel the vc_screen subsystem has a race condition in vcs_write that can lead to a null pointer dereference in vcs_notifier. The bug is triggered when the console lock is temporarily dropped to copy data from userspace. If the virtual console (vc) is deallocated while the lock is released, a subsequent call to vcs_vc() returns NULL. The code then calls vcs_scr_updated() passing the stale pointer, and the notifier chain dereferences it, causing a KASAN error and a kernel panic. The resulting crash denies system availability but does not give an attacker code execution or remote access. The weakness is a classic NULL‑pointer dereference (CWE‑476).

The vulnerability affects all Linux kernel builds that include the vc_screen module and have not yet incorporated the patch that adds a NULL check before calling vcs_scr_updated(). The patch is present in kernel releases after the commit referenced in the references list; any kernel older than that commit is potentially vulnerable. Because the affected code is part of the core kernel, the issue is not limited to a specific distribution or architecture.

The CVSS score of 5.5 indicates medium severity. The EPSS score of less than 1% shows a very low likelihood of exploitation. The race condition requires that an attacker has the ability to perform concurrent console writes, which implies local or privileged access. No public exploits are known, and the bug does not provide a remote payload. However, if exploited in a critical environment, it can take systems offline. The vulnerability is not listed in CISA's KEV catalog.