CVE-2026-85150 Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-80756

This Linux kernel vulnerability affects the SELinux subsystem. When the first policy load fails during selinuxfs tree construction, sel_write_load() calls selinux_policy_cancel(), which dereferences a NULL state->policy pointer (no outgoing policy exists on the initial load). The bug is trigge...

EUVD-2026-70360

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

CVE-2026-80756 selinux: do not cancel a policy conversion that never started

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

CVE-2026-80756 selinux: do not cancel a policy conversion that never started

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started selwriteload calls selinuxpolicycancel when selmakepolicynodes fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first...

EUVD-2026-70356

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80751

CVE-2026-80751 affects the Linux kernel 's MediaTek manufacturing PM domain driver (pmdomain/mediatek/mfg). The function mtk_mfg_attach_dev() reads the local variable prev_o on the first iteration of its loop before it is assigned, causing it to evaluate an indeterminate value. If that value is n...

EUVD-2026-70355

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

CVE-2026-80751 pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

CVE-2026-80752 Input: psxpad-spi - set driver data before use

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

CVE-2026-80743

CVE-2026-80743 affects the Linux kernel's ASoC xilinx formatter_pcm driver . The root cause is a race condition: IRQ handlers call dev_get_drvdata() to retrieve driver data, but that data is only assigned at the end of the probe function—after devm_request_irq(). If an interrupt fires in that win...

CVE-2026-80743 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

CVE-2026-80743 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

CVE-2026-80738

CVE-2026-80738 affects the Linux kernel BPF subsystem. The functions bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer typed as ARG_PTR_TO_BTF_ID_SOCK_COMMON but access sk->sk_protocol without verifying the socket is a full socket rather than a mini-socket. The fix chec...

CVE-2026-80738 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

CVE-2026-80738 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

EUVD-2026-70339

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...

CVE-2026-80730

CVE-2026-80730 affects the Linux kernel's ring-buffer subsystem. The root cause is in test_ringbuffer()'s out_free cleanup loop: the !rb_threads[cpu] check only catches NULL entries but misses entries holding an ERR_PTR . When kthread_run_on_cpu() fails, it stores ERR_PTR(-ENOMEM) or ERR_PTR(-EIN...

CVE-2026-80730 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERRPTR to kthreadstop In testringbuffer's outfree cleanup loop, the check !rbthreadscpu only catches NULL entries and misses entries that hold an ERRPTR. rbthreads is static, so unassigned slots are...