CVE catalog
CVE-2023-54198
linux: CVE-2023-54198
- Severity
- High · CVSS 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.15% · Oct 25, 2026
In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number. To reproduce: qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270" This crashes with: [ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | linux | sid | 7.2.12-1 | fixed |
| Debian | linux | forky | 7.2.12-1 | fixed |
| Debian | linux | trixie | 6.12.107-1 | fixed |
| Debian | linux | trixie-security | 6.12.113-1 | fixed |
| Debian | linux | bookworm | 6.1.176-1 | fixed |
| Debian | linux | bookworm-security | 6.1.190-1 | fixed |
| Linux | Kernel | Not reported | 4.14.308 | fixed |
| Linux | Kernel | Not reported | 4.19.276 | fixed |
| Linux | Kernel | Not reported | 5.4.235 | fixed |
| Linux | Kernel | Not reported | 5.10.173 | fixed |
| Linux | Kernel | Not reported | 5.15.100 | fixed |
| Linux | Kernel | Not reported | 6.1.18 | fixed |
| Linux | Kernel | Not reported | 6.2.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | linux | source | sid | 6.1.20-1 | not yet assigned | Not reported | Not reported |
| Debian | linux | source | forky | 6.1.20-1 | not yet assigned | Not reported | Not reported |
| Debian | linux | source | trixie | 6.1.20-1 | not yet assigned | Not reported | Not reported |
| Debian | linux | source | bookworm | 6.1.20-1 | not yet assigned | Not reported | Not reported |
| Linux | Kernel | Linux | Not reported | 4.14.308 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 4.19.276 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 5.4.235 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 5.10.173 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 5.15.100 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 6.1.18 | Not reported | CVE-2023-54198 | Not reported |
| Linux | Kernel | Linux | Not reported | 6.2.5 | Not reported | CVE-2023-54198 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2023-54198]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-54198]
- [https://security-tracker.debian.org/tracker/CVE-2023-54198]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54198.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2941.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]