PT-2026-69574

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In struct trace event call, the module pointer and the refcnt atomic variable share the same memory space within a union. For dynamic events—including kprobe, uprobe, fprobe, eprobe, or...

PT-2026-69591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the irq work sync function, which is called by rhashtable destroy, when unbinding the ath12k driver. This issue affects the ath12k link sta hash tabl...

PT-2026-69594

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the RX worker when handling PKT TYPE TXRX NOTIFY events on non-mmio buses, such as USB and SDIO. The functions mt7921 rx check and mt7921 queue rx sk...

CVE-2026-68239: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68275: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68308: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68337: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

PT-2026-69466

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2 Description A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server...

CVE-2026-68306: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68362: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

CVE-2026-68327: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-11810: NULL Pointer Dereference

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

PT-2026-69947

Name of the Vulnerable Software and Affected Versions UpdateHub affected versions not specified Description The UpdateHub firmware-update agent contains a flaw in its probe handler z impl updatehub probe within subsys/mgmt/updatehub/updatehub.c. The handler parses JSON metadata from an update...

PT-2026-69673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Issues exist in the context pstate handling code within the drm/amdgpu component. The most critical problems include potential use-after-free and NULL pointer dereferences during context...

CVE-2026-68273: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

PT-2026-69717

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the pds core component when adding or deleting auxiliary devices in the slot pf-vfsvf id.padev. This occurs between the pdsc reset done function of a Virtual...

CVE-2026-68191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

CVE-2026-68174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68345: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

PT-2026-69643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the drm/i915/gem component. This happens when a context engine slot N is set to I915 ENGINE CLASS INVALID or I915 ENGINE CLASS INVALID NONE, and an...