CVE-2021-24086-exp

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 "Windows TCP/IP Denial of Service Vulnerability ", a NULL dereference in tcpip.sys patched by Microsoft in February 2021. According to this tweet, the vulnerability has been found by @piazzt. It is triggerable remotely by sending...

CVE-2025-68325

CVE-2025-68325 schcake doesn't consider the case when cakeenqueue returns a non-null result, leading to the imbalanced qlen in the qdisc tree, triggering null-deref in its parent sched, e.g., qfq. Affected Versions Fixed at v6.19-rc1 Severity Low Patch In cakedrop, qdisctreereducebacklog is used ...

CVE-2026-82389 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...

CVE-2026-82389

The Zephyr RTOS Bluetooth stack is vulnerable to a NULL pointer dereference in the Bluetooth Classic Hands-Free Profile (HFP) Audio Gateway role. The root cause is that bt_hfp_ag_connect() performs a memset() on the entire AG object upon a failed bt_rfcomm_dlc_connect() call, while an embedded no...

CVE-2025-4476-Exploit

CVE-2025-4476-Exploit A small Python test client to send HTTP GET requests with an oversized Authorization: Basic header. This tool is intended for lab testing and research into header-parsing issues e.g., null-dereference / crash bugs such as CVE-2025-4476 in libsoup. It demonstrates how a...

cve-2026-23398-poc

Lab: CVE-2026-23398 ICMP / ipnopmtudisc=3 Reproducible lab for the Linux kernel bug in icmptagvalidation NULL dereference when net.ipv4.ipnopmtudisc = 3 and a Fragmentation Needed ICMP arrives whose quoted inner IPv4 header uses a protocol number with no handler in inetprotos. Authorized use only...

CVE-2026-90782-s2opc-status-clobber

CVE-2026-90782 — S2OPC Status-Clobbering NULL Dereference Standalone proof-of-concept for CVE-2026-90782 in S2OPC Safe & Secure OPC. Vulnerability In allocnotificationmessageitems S2OPC 1.7.3 and earlier: A single shared status variable is used for both DataChange and Event allocations. If the...

BIT-PILLOW-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-99058

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2021-24086

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 "Windows TCP/IP Denial of Service Vulnerability ", a NULL dereference in tcpip.sys patched by Microsoft in February 2021. According to this tweet, the vulnerability has been found by @piazzt. It is triggerable remotely by sending...

CLSA-2026-1778071148 openssl: Fix of 5 CVEs

CVE-2026-28387: fix use of OPENSSLfree instead of X509free on dane-mcert in danematch X509 reference-count bypass / UAF - CVE-2026-28388: fix NULL deref in checkdeltabase when a delta CRL carries the Delta CRL Indicator extension but lacks a CRL Number - CVE-2026-28389: fix NULL deref in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142675 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if t...

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-27H8-GF7J-V5HC Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand Commit: a707c6b21c313880d0771e54965d142dd42358b6...

K000163825: Linux kernel vulnerabilities CVE-2026-46110 and CVE-2026-46115

Security Advisory Description CVE-2026-46110 In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them a...

CVE-2026-89901

A flaw was found in the Linux kernel's airspy media driver. When a streaming user disconnects and then closes the device, the airspystopstreaming function attempts to access a USB device structure that has already been cleared. This leads to a NULL dereference, which can result in a system crash...

CLSA-2026-1788168285 kernel: Fix of 193 CVEs

mac802154: llsec: reject frames shorter than the authentication tag CVE-2026-68125 - KVM: x86/mmu: Fix use-after-free on vendor module reload CVE-2026-68428 - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper CVE-2026-68197 - bpf: account for current allocated stack depth...

CLSA-2026-1779987841 kernel: Fix of 110 CVEs

smb: client: reject userspace cifs.spnego descriptions - mlxsw: spectrumacltcam: Fix possible use-after-free during rehash CVE-2024-35854 - cifs: Fix memory leak when build ntlmssp negotiate blob failed CVE-2022-50372 - scsi: lpfc: Check kzalloc in lpfcsli4cgnparamsread CVE-2023-53038 -...

SUSE CVE-2026-98688

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-93172

A flaw was found in the Linux kernel's memory management mm/mminit. A missing allocation check for pgdat-percpunodestats can lead to a NULL dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service DoS...