CVE-2026-48756

CVE-2026-48756 is a nil-pointer dereference (CWE-476) in Incus , a system container and VM manager. The vulnerable function CreateCustomVolumeFromBackup in internal/server/storage/backend.go dereferences *snapshot.ExpiresAt without a nil-check when importing a custom-volume backup whose volume_sn...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-74552

A flaw was found in the Linux kernel's hwmon lm90 driver. A local user can trigger a null pointer dereference by reading sysfs attributes before the driver's registration is complete. This can lead to a system crash, resulting in a denial of service...

CVE-2026-14456 vulnerabilities

Vulnerabilities for packages: openssl...

SUSE CVE-2026-68235

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...

SUSE CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

SUSE CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

SUSE CVE-2026-68243

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

SUSE CVE-2026-68248

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

EUVD-2026-63724

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference...

EUVD-2026-63638

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a NULL pointer dereference...

ROS-20260821-73-0006

The vulnerability of the bufferprepare function in the driver/media/pci/cx23885/cx23885-core.c file of the Linux operating system’s multimedia device driver library is related to the dereferencing of pointers due to lack of checking of the return value. Exploiting this vulnerability could allow a...

PT-2026-80290

Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...

CVE-2026-76905: NULL Pointer Dereference

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001410)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001410 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opalpowercapinit kasprintf returns a pointer to...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102095 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expectedattachtype for tailcall compatibility Yinhao et al. recently reported: Our...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102059)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102059 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check NULL before accessing WHAT IGT kmscursorlegacy's...

CVE-2026-17251: NULL Pointer Dereference

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002993 advisory. A null pointer dereference vulnerability was found in ath10kwmitlvoppullmgmttxcomplev in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue...

CVE-2026-47753: NULL Pointer Dereference

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...