CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-71922

Multiple DrayTek VigorSwitch models are affected by a pre-authentication null pointer dereference in the setget.cgi interface. The root cause is missing validation when the pass field is absent from a request, allowing a remote unauthenticated attacker to crash the service via a crafted request, ...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

EUVD-2026-64981

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920

DrayTek VigorSwitch (multiple models) contains a null pointer dereference in the formlogout function caused by missing validation of the Cookie header before string handling. A remote attacker with valid administrative credentials on the web management interface can send a crafted request to cras...

EUVD-2026-64979

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

JLSEC-2026-1386

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

CVE-2026-74610

A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...

CVE-2026-74732

A flaw was found in the Linux kernel's AMD display drm/amd/display driver. When a user turns off the display over HDMI on systems with older DCE timing generators, the driver attempts to call a function istgenabled that may not be implemented. This unconditional call can lead to a NULL pointer...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: skmsg: Fixed the incorrect last sg check in skmsgrecvmsg. Also, one instance of a kernel NULL pointer dereferencing was fixed as follows: 224.462334 Call Trace: 224.462394 tcpbpfrecvmsg+0xd3/0x380 224.462441 ? sockhasperm+0x78/0x...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usb: dwc3-meson-g12a: Fixed an issue where the USB2 PHY glue initialization was performed when PHY0 was disabled. When only PHY1 is used for example, on Odroid-HC4, the regmap initialization code uses USB2 ports without...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: octeontx2 – remove the CONFIGDMCRYPT check No issues were found when using the driver with dm-crypt enabled. Therefore, the CONFIGDMCRYPT check in the driver can be removed. This also fixes the NULL pointer dereference...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: uprobes: Fixed a NULL pointer dereference in hprobeexpire. Forking a task that has a pending uretprobe can lead to an error in the kernel, involving a NULL pointer dereference in the clone function path: - Bug: NULL pointer...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dma-fence: Fixed the potential issue of dereferencing a null pointer in tracedmafinesignaled, tracedmafinewaitend, and tracedmafinedestroy. After the fence signalling is reset, a null fence-ops pointer may be dereferenced. We...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tpmcrb: Add a check for ACPICOMPANION against NULL during the probe. Every platform driver can be forced to match a device that does not match its list of device IDs due to devicematchdriveroverride. Therefore, platform drivers...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/vmwgfx: Avoid calling destroyworkqueueNULL in case of vkms initialization failures. There are two possible paths through vmwvkmsinit that may result in vmw-crcworkq being set to NULL, while still leaving the rest of the...