PT-2026-64594

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreq suspend is called via the kernel restart - device shutdown path. Unlike the normal system suspend path, the reboot path does not call freeze processes,...

Linux Distros Unpatched Vulnerability : CVE-2026-64480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: ice1712: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. The ice1712 driver calls sndctlnew1 without checking the...

Linux Distros Unpatched Vulnerability : CVE-2026-64486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: cmipci: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndcmipcispdifcontrols does not check the return value befo...

PT-2026-64625

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso conn big sync iso conn big sync drops the socket lock to call hci get route and then re-acquires it, but dereferences iso pisk-conn-hcon afterwards without re-checking that conn is...

Linux Distros Unpatched Vulnerability : CVE-2026-64488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: aoa: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. In layout.c, the function does not check the return value befo...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the defaultContentParameterDecoder function. An attacker can cause the application to crash or abort request processing by sending a crafted HTTP request that targets an OpenAPI operation with a content...

swift-nio-http2: Missing CR/LF/NUL validation in header values

Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. Impact Two related gaps in inbound header...

CVE-2026-64230

In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...

DEBIAN-CVE-2026-64234

In the Linux kernel, the following vulnerability has been resolved: tty: serial: pchuart: add check for dmaalloccoherent Add a check for dmaalloccoherent failure to prevent a potential NULL pointer dereference in dmahandlerx. Properly release DMA channels and the PCI device reference using a goto...

DEBIAN-CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...

DEBIAN-CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...

CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

DEBIAN-CVE-2026-64220

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode-secondary to NULL in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing allocation functio...

CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

DEBIAN-CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

CVE-2026-64212

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwlmldremovelink, the link-fwid is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference and out-of-bounds read in the native XXHash implementations reached through XXHashFactory.nativeInstance, where SafeUtils.checkRange skips all array validation when len == 0 and lets invalid references or ranges...

NULL Pointer Dereference

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to NULL Pointer Dereference and out-of-bounds read in the native XXHash implementations reached through XXHashFactory.nativeInstance, where...

CVE-2026-64253

In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...