CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

CVE-2026-18417

The Zephyr RTOS native BSD-socket layer contains a wild pointer dereference vulnerability when a TCP listening socket reports an asynchronous error. The root cause is type-punning an error status into the user_data field of struct net_context. In version v4.3.0 , a second interface-down event can...

SUSE CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

AZL-101682 CVE-2026-89849 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

DEBIAN-CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89849

This vulnerability affects the qla2xxx SCSI driver in the Linux kernel . The root cause is a logic flaw in qla2x00_status_entry(): after filtering out certain SRB types, the code falls through to a SCSI fast path that unconditionally assumes the command is an SRB_SCSI_CMD. Because the srb union o...

CVE-2026-89849 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89849: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

Linux Distros Unpatched Vulnerability : CVE-2026-89849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non- TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD type...

PT-2026-93490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx driver where the qla2x00 status entry function fails to properly validate SCSI Request Blocks SRB before they enter the SCSI fast path. The function filter...

Astra Linux – Vulnerability in Firefox

In some cases, JIT-compiled code might have dereferenced a wild pointer value. This could lead to a exploitable crash. This vulnerability affects Firefox versions earlier than 122...

CVE-2026-15461

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461

Zephyr RTOS HL78xx modem GNSS driver contains a type confusion caused by a struct member offset mismatch: struct gnss_nmea0183_match_data was placed as the second member instead of the first, so NMEA parse callbacks read and write state at a shifted offset. The GSV callback reads a bogus pointer ...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

EUVD-2026-75539

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

PT-2026-89424

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendor standalone/hl78xx/ embeds a generic struct gnss nmea0183 match data match data inside struct hl78xx gnss data. The generic NMEA0183 match helper drivers/gnss/gnss nmea0183 match.c requires that context ...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...