CVE-2026-93212 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93210 smb: client: harden DFS cache against invalid target hints

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

EUVD-2026-85939

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

CVE-2026-93210 smb: client: harden DFS cache against invalid target hints

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: SCTP: Stream: Fully roll back denied add-stream states When the request to add a stream ADDOUTSTREAMS is denied, SCTP only reduces the size of the queued chunks and lowers the outcnt value. This leaves the removed stream’s metada...

OPENSUSE-SU-2026:21950-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check bsc1273133. - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remot...

SUSE-SU-2026:23916-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check bsc1273133. - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remot...

CLSA-2026-1790065872 freerdp: Fix of 2 CVEs

CVE-2026-67291: fix heap out-of-bounds read in updateprocessglyphfragments; reject a GLYPHFRAGMENTADD update whose one-byte server-declared fragment size exceeds the bytes remaining in the received order buffer, instead of passing it straight to glyphcachefragmentput which copies that many bytes...

CLSA-2026-1790172301 nginx: Fix of 3 CVEs

CVE-2026-27651: fix null pointer dereference in ngxmailauthhttpmodule when clearing the password in auth http requests with CRAM-MD5/APOP - CVE-2026-27654: fix heap buffer overflow in ngxhttpdavmodule when a COPY/MOVE destination URI is shorter than the location alias - CVE-2026-27654: also...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

PT-2026-98103

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the usbip module within the vhci hcd component. The function status show vhci fails to verify if the hcd pointer returned by platform get drvdata is...

PT-2026-98080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the ACPICA component. The function acpi ns custom package unconditionally dereferences the first element of a package to read the BIX version number...

CVE-2026-88373: NULL Pointer Dereference

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88373

The libde265 library (commit 4d45a6b ) contains a NULL pointer dereference vulnerability within the NAL parsing path. When the de265_push_NAL() function is invoked with a zero-length NAL unit, it may produce a NAL_unit with a NULL backing buffer . This buffer is then used as the destination argum...

EUVD-2026-86314

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...