CVE-2026-80690: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80691: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

PT-2026-83354

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

CVE-2026-80657: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

CVE-2026-80636: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80678: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

PT-2026-82905

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow of the signed loop counter k in the picolcd send and wait function can lead to a NULL pointer dereference of raw data. This occurs if the loop executes more than INT...

PT-2026-82958

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference can occur in the dw dp remove function within the Rockchip DRM driver. This happens when the platform driver's remove callback attempts to access driver data v...

CVE-2026-80658: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

CVE-2026-80620: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

PT-2026-82920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the iounmap function is called a second time with a NULL pointer. This occurs during the error path of the msix capability init function when msix setup interrupts...

PT-2026-83004

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the Linux kernel within the drm/amd/display component. The function get ss info from atombios attempts to use calc pll cs-ctx-logger for logging via ...

CVE-2026-80614: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...

PT-2026-82914

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the emac probe function. This occurs because devm request irq is called before devm platform ioremap resource, allowing an early interrupt to trigger...

CVE-2026-80632: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80605: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-77217: Stack-based Buffer Overflow

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The webradiusSrvpost family of handlers copies the radKey, radKey0, radDftParamKey, radName, and radIp POST parameters into...

PT-2026-86724

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasd release space checks the implementation of the is ese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AN...

PT-2026-82989

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference crash can occur in the tracing/mmiotrace component. The functions mmio trace rw and mmio trace mapping retrieve mmio trace array into tr and pass it to trace...

PT-2026-82991

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iblock execute pr out function where the PRO PREEMPT, PRO PREEMPT AND ABORT, and PRO RELEASE operations perform callback capability checks via ops-pr clear. An...