PT-2026-90200

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt locks init private installs NLM file lock operations even when nlmclnt find lockowner fails to allocate a lockowner. nlmclnt proc then returns -ENOMEM, but the V...

PT-2026-90450

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg video init In uvcg video init, if kthread run worker fails, the error logged uses uvcg err, however, the pointer it uses: video-uvc is not assigned at this point, triggering ...

PT-2026-90378

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroy client releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on cl ownerstr hashtbl. client has state does not...

PT-2026-90234

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix this rq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Sever...

CVE-2026-89552: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

CVE-2026-89544: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107315 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mtinputconfigured devmkasprintf can return a NULL pointer on...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107309)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107309 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before used WHAT & HOW Poniters, such as dc-clkmgr, are null...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107330 advisory. In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

DEBIAN-CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash...

UBUNTU-CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash...

CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash...

CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash...

Security Bulletin: IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference (CVE-2026-16702)

Summary IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference CVE-2026-16702 Vulnerability Details CVEID:CVE-2026-16702 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote...

CVE-2026-88054

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

DEBIAN-CVE-2026-88054

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

EUVD-2026-75636

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

CVE-2026-88054

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NTSERIES, NTPARALLEL, or NTREVERSED layers in a crafted .traineddata model. During LSTMRecognizer...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...