CVE-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-97418

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup sndes18xxmixer creates controls with sndctlnew1 and then stores bookkeeping pointers or sets privatefree before calling sndctladd. sndctlnew1 can return NULL on...

CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...

PT-2026-104879

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup snd es18xx mixer creates controls with snd ctl new1 and then stores bookkeeping pointers or sets private free before calling snd ctl add. snd ctl new1 can return NU...

PT-2026-104908

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edcca th in rtw fw adaptivity result It was recently reported that rtw fw adaptivity result in fw.c dereferences rtwdev-chip-edcca th without a NULL check. The issue is that devices with the...

PT-2026-104953

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: goku udc: avoid NULL deref of dev-driver in INT USBRESET log goku irq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

PT-2026-104969

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, get tgt name returns ERR PTR-ENOENT when ce-tgthint is NULL, and dfs cache noreq update tgthint assumes ce-tgthint is always valid. In preparation for clearing...

PT-2026-98073

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel NULL pointer dereference occurs in the ntfs3 file system when processing a corrupted image. The issue is triggered when system.ntfs attrib is toggled and subsequently system.dos...

PT-2026-104989

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpi ns custom package acpi ns custom package unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Typ...

PT-2026-105007

In the Linux kernel, the following vulnerability has been resolved: usbip: vhci hcd: fix NULL deref in status show vhci platform get drvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. status show vhci checked for a NULL pdev but not for a NULL...

PT-2026-97973

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the LocalTalk fast path when the aarp send ddp function calls atalk find dev addrdev without verifying if the result is NULL. This issue is triggered...

CVE-2026-93825: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-97439: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: preserve non-DOS attribute bits in system.dosattrib BUG A corrupted ntfs3 image can hit a NULL function pointer call in genericperformwrite after toggling system.ntfsattrib and then overwriting system.dosattrib on the...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

EUVD-2026-86314

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88373

The libde265 library (commit 4d45a6b ) contains a NULL pointer dereference vulnerability within the NAL parsing path. When the de265_push_NAL() function is invoked with a zero-length NAL unit, it may produce a NAL_unit with a NULL backing buffer . This buffer is then used as the destination argum...

CVE-2026-88373: NULL Pointer Dereference

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-93263

In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clkinitdata eswinclkregisterpll and eswinregisterclkdiv declare a struct clkinitdata on the stack and only initialize some of its fields parentdata respectively parenthws...

PT-2026-104901

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dc update planes and stream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Ski...

CVE-2026-97519

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...