CVE-2026-90335

A flaw was found in the Linux kernel's handling of TTY devices. When a TTY device registration fails before a character device cdev is allocated, the serial core retains the port. Subsequent removal of this port can lead to a null-pointer dereference if cdevdel is called with a NULL cdev slot. Th...

CVE-2026-90294

A flaw was found in the Linux kernel. The iSER iSCSI Extensions for RDMA protocol implementation incorrectly sends a login response before the session is fully registered. A remote attacker could exploit this by sending a SCSI command immediately after receiving the premature login response. This...

CVE-2026-90186

A flaw was found in the Linux kernel's nullblk module. A local user can cause a system crash by attempting to resize device queues while a shared tag set is active. This improper handling of queue resizing leads to a null pointer dereference, which can result in a denial of service...

CVE-2026-90144

A flaw was found in the Linux kernel's dpll Digital Phase-Locked Loop subsystem. A race condition during device teardown, specifically when a dpll device unregisters while another driver still holds a pin, can lead to a NULL pointer dereference. This issue can cause a kernel crash, resulting in a...

CVE-2026-90192

A flaw was found in the Linux kernel's qcom-cpucp mailbox driver. The qcomcpucpmboxsenddata function, responsible for sending data, did not properly handle a NULL data pointer when mailboxclearchannel attempted to notify the remote side that the receive RX channel was cleared. This blind...

CVE-2026-90172

A flaw was found in the Linux kernel's smbdirect module, which handles high-performance data transfer using Remote Direct Memory Access RDMA. During an RDMA connection attempt, if the connection acceptance fails, the system incorrectly deallocates memory resources before all related operations ar...

CVE-2026-90166

A flaw was found in the ksmbd Server Message Block server component of the Linux kernel. A remote attacker could exploit a null-pointer dereference vulnerability within the ksmbdipctreeconnectrequest function. This issue arises when the system attempts to access a memory location that has not bee...

CVE-2026-90164

A flaw was found in the Linux kernel's ksmbd server component. During the server's initialization process, an error in setting up internal process entries or counters is not handled correctly. This oversight can result in the system attempting to access a null pointer, which may lead to a system...

CVE-2026-90149

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles implementation. When an NFSv4.0 data server is used, two code paths incorrectly assume the client has a session, leading to a NULL pointer dereference. This issue can cause the kernel to crash, resulting in a...

CVE-2026-90148

A flaw was found in the Linux kernel's NFSv4 component. When the nfs4addlease function races with a delegation return, it can pass an incorrect, potentially null, argument to nfs4deletelease. This incorrect argument eventually leads to a null pointer dereference, which could allow a local attacke...

CVE-2026-77095

Commvault installations, including CommServe , Webserver , Command Center , MediaAgents , Clients , and HyperScale , are affected by a null pointer dereference vulnerability in CvFWD . This flaw impacts service availability . To remediate this issue, customers should upgrade to the resolved maint...

CVE-2026-77095 CvFWD Null Pointer Dereference

CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109942

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...

DEBIAN-CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

DEBIAN-CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

UBUNTU-CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...