CVE-2026-53007

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-53007

CVE-2026-53007 affects the Linux kernel ice driver. The vulnerability arises when ice_set_ringparam() clears tstamp_ring of temporary tx_rings without clearing ICE_TX_RING_FLAGS_TXTIME. If ICE_TX_RING_FLAGS_TXTIME is set and ice_setup_tx_ring() then fails, unwinding can dereference a NULL tstamp_...

CVE-2026-52998

CVE-2026-52998 affects the Linux kernel’s netfilter nfnetlink_osf module. The nf_osf_ttl() function can dereference a device pointer (skb->dev) without validating the device, risking a NULL dereference. The patch removes the device dereference and the in_dev_for_each_ifa_rcu loop used to match...

CVE-2026-52998

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix potential NULL dereference in ttl check The nfosfttl function accessed skb-dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the...

CVE-2026-52997

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: drain both C-queue and L-queue in dualpi2change Fix dualpi2change to correctly enforce updated limit and memlimit values after a configuration change of the dualpi2 qdisc. Before this patch, dualpi2change...

CVE-2026-52957 libceph: Fix potential null-ptr-deref in decode_choose_args()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52957

Consolidated details from CVE-2026-52957 show a Linux kernel libceph flaw in processing CEPH_MSG_OSD_MAP: during CRUSH map decoding, bucket indices may reference NULL buckets when decoding crush_choose_arg_map, risking a NULL pointer dereference. A patch extends the validation to only access non-...

CVE-2026-52957

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52957 libceph: Fix potential null-ptr-deref in decode_choose_args()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52941

A flaw was found in the Linux kernel's net/smc module. An unprivileged local user could trigger a null pointer dereference by performing sendmsg or recvmsg operations on an SMC-D Shared Memory Communications - Direct socket while the smcmsgevent tracepoint is enabled. This can lead to a general...

CVE-2026-52938

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF storage. A race condition can occur where a storage element is accessed after its associated map has been deallocated, leading to a null pointer dereference. This can cause a kernel crash, resulting in a Denial of Service DoS for t...

CVE-2026-52922

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking module. This vulnerability occurs because the batadvdatforwarddata function fails to validate the success of a memory allocation operation. An attacker could exploit this by triggering a scenario where t...

CVE-2026-52939

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. An unprivileged local user can trigger a kernel panic by sending a specially crafted atomic control message cmsg over an active RDS/InfiniBand IB connection. This issue is caused by improper handling of masked atomic...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fixed a NULL dereference when deactivating an inactive aggregate in qfqreset. qfqclass-leafqdisc-q.qlen 0 does not imply that the class itself is active. Two qfqclass objects may point to the same leafqdisc. Th...

Astra Linux – Vulnerability in libstb

In Libsixel, prior to and including version 1.10.3, a NULL pointer dereferencing in the stbimage.h component of libsixel allows attackers to cause a denial of service DOS through a crafted PICT file...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: The issue involves fixing a situation where the NULL pointer of the DMA device was dereferenced, without ensuring that cdnsctrl-dmac was properly initialized first. The pointer dmadev was being dereferenced...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/siw: Fixed a potential NULL pointer dereference during header processing. If siwgethdr returns -EINVAL before setrxfpducontext, qp-rxfpdu can be NULL. The error path in siwtcprxdata dereferences qp-rxfpdu-moreddpsegs...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: The issue of checking the received length in large packets has been fixed. Since commit 4959aebba8c0 “virtio-net: Use the MTU size as the buffer length for large packets”, when the guest gso is disabled, the allocated...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ACPI: Processor: Fixed NULL-pointer dereferencing in acpiprocessorerratapiix4 In acpiprocessorerratapiix4, the pointer dev is first assigned an IDE device, and then reassigned as an ISA device: dev = pcigetsubsys...,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: md/raid5: Fixed possible null-pointer dereferences in raid5storegroupthreadcnt. The variable mddev-private is first assigned to conf, and then checked: c conf = mddev-private; if !conf… If conf is NULL, then mddev-private is also...