CVE-2026-97508

The Linux kernel contains a vulnerability related to the thunderbolt subsystem. The issue arises because tb->root_switch is not properly set to NULL when a domain is stopped. Fixing this ensures that tb_xdp_handle_request() correctly returns an error to the remote host while maintaining the uu...

EUVD-2026-86104

In the Linux kernel, the following vulnerability has been resolved: crypto: ixp4xx - fix buffer chain unwind on allocation failure chainupbuffers builds a linked list of buffer descriptors for a scatterlist. If dmapoolalloc fails while constructing the list, the current code sets buf to NULL and...

CVE-2026-97506

The Linux kernel contains a vulnerability in the crypto: ixp4xx component where a null-pointer dereference can occur during buffer chain construction. Specifically, if dma_pool_alloc() fails within the chainup_buffers() function, the code incorrectly sets the buffer pointer to NULL and subsequent...

CVE-2026-97484

The Linux kernel contains a NULL pointer dereference vulnerability in the usbip: vhci_hcd component. The issue occurs because platform_get_drvdata() can return NULL if a VHCI host controller's probe fails (e.g., due to USB bus number exhaustion). The status_show_vhci() function fails to check for...

EUVD-2026-86082

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. statusshowvhci checked for a NULL pdev but not for a NULL hcd...

CVE-2026-97482

The Linux kernel contains a vulnerability in the goku_udc USB gadget driver where the goku_irq() function performs a NULL pointer dereference . The issue occurs when an INT_USBRESET event is received before a gadget driver is bound or after it has been unbound. In these scenarios, dev->driver ...

EUVD-2026-86080

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

EUVD-2026-86078

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: protect against NULL uart-port.dev in register serial8250register8250port conditionally copies uart-port.dev from up-port.dev only when up-port.dev is non-NULL: if up-port.dev uart-port.dev = up-port.dev; ... S...

CVE-2026-97446

The Linux kernel contains a NULL pointer dereference vulnerability within the ACPICA component in the acpi_ns_custom_package() function. The flaw occurs because the function unconditionally dereferences the first element of a package to read the _BIX version number without verifying if the refere...

EUVD-2026-86059

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...

CVE-2026-97439

The Linux kernel 's ntfs3 file system driver is vulnerable to a NULL function pointer dereference when handling a corrupted ntfs3 image. The issue occurs in generic_perform_write() after toggling system.ntfs_attrib and subsequently overwriting system.dos_attrib on the same file. The root cause is...

EUVD-2026-86052

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: preserve non-DOS attribute bits in system.dosattrib BUG A corrupted ntfs3 image can hit a NULL function pointer call in genericperformwrite after toggling system.ntfsattrib and then overwriting system.dosattrib on the...

CVE-2026-97431

The Linux kernel contains a vulnerability in the drm/amd/display component. The issue arises because calling dc_update_planes_and_stream separately for a stream and its phantom stream leads to a NULL pointer dereference , as the phantom is destroyed during the first call. The fix involves skippin...

EUVD-2026-86044

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip th...

EUVD-2026-86031

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup sndes18xxmixer creates controls with sndctlnew1 and then stores bookkeeping pointers or sets privatefree before calling sndctladd. sndctlnew1 can return NULL on...

CVE-2026-97418

The Linux kernel contains a vulnerability in the ALSA subsystem's es18xx driver. The function snd_es18xx_mixer() fails to verify if snd_ctl_new1() successfully allocated memory before attempting to store bookkeeping pointers or set private_free. This leads to a NULL pointer dereference if the all...

EUVD-2026-86027

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365afesuspend mt8365afesuspend allocates the register backup buffer with devmkcalloc, but does not check for allocation failure before using the returne...

CVE-2026-97414

The Linux kernel contains a vulnerability in the ASoC: mediatek: mt8365-afe-pcm driver. The mt8365_afe_suspend() function allocates a register backup buffer using devm_kcalloc() but fails to verify if the allocation succeeded. This lack of checking can lead to a NULL-pointer dereference when acce...

EUVD-2026-86214

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-93825

The Linux kernel contains a vulnerability where a NULL pointer dereference can occur within the spi subsystem. Specifically, the function spi_get_device_match_data() fails to perform a NULL check on the return value of spi_get_device_id(). This issue can be triggered when using driver_override wi...