CVE-2026-97980 s390/debug: Fix NULL pointer dereference in debug_set_level()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

EUVD-2026-86632

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97978

The Linux kernel contains a vulnerability in the eth: ice driver where the ice_tx_dim_work event triggers a double dereference in TP_printk(). This occurs because the tracing subsystem attempted to access pointers (specifically the ring or dim instance) long after the event was recorded, resultin...

CVE-2026-97978 eth: ice: don't dereference pointers from TP_printk()

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97978 eth: ice: don't dereference pointers from TP_printk()

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97978

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97975

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth hci_sysfs component. A race condition exists between hci_conn_del_sysfs() and concurrent child device unregistration (such as a BNEP network device calling unregister_netdev()). During unregistration, device_del()...

EUVD-2026-86629

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97974 ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97974 ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97947

The Linux kernel contains a vulnerability in the x86/amd_node component where amd_smn_read() and amd_smn_write() functions could trigger a NULL pointer dereference . This occurs because these functions are exported around __amd_smn_rw(), making them accessible even if amd_smn_init() fails. In suc...

EUVD-2026-86801

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97947 x86/amd_node: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97947 x86/amd_node: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97947

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97932

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed. Keep the...

CVE-2026-97916

The Linux kernel contains a vulnerability in the accel/ivpu driver related to how firmware log buffer metadata is handled. The tracing log headers are stored in DMA-shared Buffer Objects (BOs) , which the NPU firmware can modify. While fw_log_from_bo() validates the header_size and size fields, f...