IOFireWireFamily-null-deref

IOFireWireFamily-null-deref IOFireWireFamily-null-deref is a proof-of-concept exploit for CVE-2017-2388, a NULL pointer derefererence in IOFireWireUserClient that was fixed in macOS Sierra 10.12.4. This vulnerability can be triggered to cause denial of service on devices with a FireWire port...

CVE-2009-2692

CVE-2009-2692 Linux Null pointer dereference This is just the compiled binary of the code available in https://www.exploit-db.com/exploits/9545/ Compiled for education purposes It was compiled under CentOS 4.8...

CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver GFACSysx64.sys | ---|--- CVE IDs| CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 Vendor| Little Orbit Product| GamersFirst Anti-Cheat GFAC Driver GFACSysx64.sys Affected Versions| No version information is embedded in...

CVE-2026-90024

CVE-2026-90024 affects the Linux kernel USB gadget MIDI 2.0 function (drivers/usb/gadget/function/f_midi2.c). When the block direction is set to SNDRV_UMP_DIR_INPUT via configfs, the midi1_ep_out endpoint initialization is skipped during the gadget bind phase, leaving usb_ep->card as NULL . La...

EUVD-2026-80632

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...

CVE-2026-90023

CVE-2026-90023 is a null pointer dereference in the Linux kernel USB gadget f_mass_storage driver, specifically in fsg_common_set_num_buffers(). The root cause is that the earlier removal of fsg_num_buffers_validate() relied on Kconfig limits (2–256) for the buffer count n, but a user can write p...

EUVD-2026-80631

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...

CVE-2026-90019

CVE-2026-90019 affects the Linux kernel USB gadget subsystem. In the UVC function implementation, usb_put_function_instance() dereferences fi->fd to retrieve the module reference in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so...

EUVD-2026-80627

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...

CVE-2026-90020

CVE-2026-90020 affects the Linux kernel USB gadget subsystem. The vulnerability is a race condition in gadget_dev_ioctl(): the function reads dev->gadget before acquiring dev->lock, but checks dev->state only after acquiring the lock. A concurrent bind can change the device state between...

CVE-2026-89994 dmaengine: fsl-edma: tracing: no ptr dereference during log output

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...

CVE-2026-89994

CVE-2026-89994 affects the Linux kernel 's fsl-edma DMA engine driver . The fsl-edma trace events store a pointer to struct fsl_edma_engine in the ringbuffer and dereference it during log output, at which point the pointer may already be invalid (use-after-free) . A local user with tracing access...

CVE-2026-89993

CVE-2026-89993 affects the Linux kernel in the dmaengine dw-edma driver. The root cause is an initialization-order bug: dw_edma_irq_request() passes struct dw_edma_irq to request_irq() before dw_edma_channel_setup() fills the back pointer. As a result, a shared interrupt can enter the handler wit...

EUVD-2026-80601

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

EUVD-2026-80566

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-89966

CVE-2026-89966 affects the Linux kernel in the mm/hugetlb_cma subsystem. The root cause is a NULL nodemask dereference in hugetlb_cma_alloc_frozen_folio(): when alloc_buddy_hugetlb_folio_with_mpol() passes a NULL nodemask as a fallback for gigantic (e.g., 1 GB) hugepage allocations, the function ...

CVE-2026-89963

CVE-2026-89963 affects the Linux kernel in the powerpc/kexec_file subsystem. A potential NULL pointer dereference exists in the function kexec_extra_fdt_size_ppc64() : on platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving the pointer 'rmem' unal...

EUVD-2026-80563

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

CVE-2026-89958

This vulnerability affects the Linux kernel 's s390/vfio-ap driver. The root cause is a NULL pointer dereference : the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete callback functions acquire the matrix_mdev->kvm->lock mutex without first checking whether matrix_mdev->kvm is NULL. ...