CVE-2026-79976 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-105923

A flaw was found in qt6. An attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the application. When the VectorImage component processes a specially crafted Scalable Vector Graphics SVG file, an integer calculation error triggers an invalid memory access...

CVE-2026-98637

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64. When a virtual CPU vCPU fails to initialize Scalable Vector Extension SVE support, feature flags are improperly handled, leaving subsequent vCPUs in an inconsistent state without allocated memory. A guest...

CVE-2026-80752

A flaw was found in the Linux kernel's psxpad-spi driver. This vulnerability occurs because the psxpadspisuspend function attempts to access controller state before it has been properly initialized, leading to a null pointer dereference. A local attacker could exploit this to cause a system crash...

CVE-2026-80743

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture System on Chip ASoC xilinx formatterpcm component. This vulnerability arises when interrupt request IRQ handlers attempt to access driver data before it has been fully initialized during device setup. An interrupt occurring ...

CVE-2026-90024

A flaw was found in the Linux kernel's USB MIDI 2.0 gadget function. When the MIDI 2.0 gadget is configured with a specific input block direction, an endpoint may not be properly initialized. During subsequent endpoint cleanup, an attempt to access this uninitialized endpoint can lead to a...

CVE-2026-89780

A flaw was found in the Qualcomm rmnet driver of the Linux kernel. An unprivileged local user can exploit this vulnerability by manipulating network namespaces and rmnet link configurations. This can lead to a null-pointer dereference when processing deaggregated frames, causing a kernel panic an...

CVE-2026-80846

A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This can lead to a system crash, resulting in a Denial of Service...

CVE-2026-80819

A flaw was found in the Bluetooth RFCOMM Radio Frequency Communication subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect DISC message to a device with a deferred RFCOMM channel. This can lead to a null pointer dereference when the system attempts t...

CVE-2026-80817

A flaw was found in the Linux kernel's iommu/iommufd component. A local user could exploit a race condition during the processing of I/O address space IOAS areas. This vulnerability occurs when iommufdioaschangeprocess attempts to access an IOAS area before its pages are fully mapped, leading to ...

CVE-2026-80813

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmetexecuteidentifynslist function by issuing a specific Identify command CNS 07h. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...

CVE-2026-80771

A flaw was found in the Linux kernel's Nintendo Joy-Con driver. A local attacker could potentially trigger a null pointer dereference by sending a concurrent force-feedback FFRUMBLE command while the device is being registered. This could lead to a system crash, resulting in a Denial of Service D...

CVE-2026-80756

A flaw was found in the SELinux subsystem of the Linux kernel. A local attacker could trigger a null pointer dereference by attempting to load a policy when no old policy exists and the policy conversion fails. This issue, reachable through a write operation to /sys/fs/selinux/load, could lead to...

SUSE CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

SUSE CVE-2026-113680

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2025-60469

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2026-90039

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities could trigger a null pointer dereference by attempting to unlock a filesystem or export via specific netlink commands before the NFSD internal tables are fully initialized...

CVE-2026-90023

A flaw was found in the Linux kernel's USB mass storage gadget function. An attacker could exploit this by providing a specially crafted input that sets the number of buffers to an invalid value, such as zero or one. This bypasses intended restrictions and leads to a null pointer dereference. The...

CVE-2026-90020

A flaw was found in the Linux kernel's USB gadget subsystem. A race condition in the gadgetdevioctl function, where a pointer is read before a lock is acquired, can lead to a null pointer dereference. A local attacker could exploit this timing issue during a concurrent bind operation, potentially...

CVE-2026-89993

A flaw was found in the Linux kernel's dmaengine: dw-edma driver. A local attacker could exploit a timing issue where interrupt data is not fully initialized before an interrupt is requested. This could lead to a NULL pointer dereference when a shared interrupt handler is invoked, causing the...