CVE-2026-48521 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

Linux Distros Unpatched Vulnerability : CVE-2026-90184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of...

Linux Distros Unpatched Vulnerability : CVE-2026-90144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via...

Linux Distros Unpatched Vulnerability : CVE-2026-90429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback...

Linux Distros Unpatched Vulnerability : CVE-2026-90080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Represento...

Linux Distros Unpatched Vulnerability : CVE-2026-90085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been...

Linux Distros Unpatched Vulnerability : CVE-2026-93073

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for...

Linux Distros Unpatched Vulnerability : CVE-2026-90282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after...

Linux Distros Unpatched Vulnerability : CVE-2026-93172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when...

CVE-2026-93172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

DEBIAN-CVE-2026-93172

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

AZL-102893 CVE-2026-93172 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

DEBIAN-CVE-2026-90429

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90429

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

AZL-101852 CVE-2026-90294 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

AZL-101996 CVE-2026-90293 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

AZL-102404 CVE-2026-90281 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-90280

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

AZL-101939 CVE-2026-90280 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90144

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...