CVE-2026-113680

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2026-113680

The HarfBuzz library, versions 8.0.0 through 14.6.0 , contains a NULL pointer dereference vulnerability within the experimental WebAssembly shaper host imports, specifically affecting buffer_set_contents, face_create, and font_set_coords. A remote attacker can trigger a Denial of Service (DoS) by...

CVE-2026-93124

A flaw was found in the Linux kernel's asus-wireless driver. When the driver is force-bound to a device lacking an ACPI Advanced Configuration and Power Interface companion object, it can lead to a NULL pointer dereference. This occurs because the asuswirelessprobe function incorrectly stores a...

CVE-2026-93180

A flaw was found in the panthor component of the Linux kernel. A local attacker could exploit this vulnerability by performing a partial unmap of an evicted Buffer Object BO when the Graphics Processing Unit GPU mapping is split. This occurs because the logic for handling partial unmap of huge...

CVE-2026-93139

A flaw was found in the AMDGPU driver within the Linux kernel. An issue with the hungqueuedbarray loop limit for multi-XCC Cross-Chiplet Interconnect GPUs can leave array entries uninitialized. This can lead to a null pointer dereference when accessing arrays indexed by XCC ID greater than or equ...

CVE-2026-93115

A flaw was found in the Linux kernel's Mellanox mlxbf-pmc driver. A local attacker could exploit this by forcing the driver to bind to a device lacking an ACPI Advanced Configuration and Power Interface companion object. This action triggers a NULL pointer dereference, which can lead to a system...

CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer...

CVE-2026-93068

A flaw was found in the Linux kernel's AMD display DM I2C adapter. A race condition exists where the DM I2C adapters remain visible to userspace while the DM teardown is in progress. A local attacker could exploit this by initiating a concurrent i2c-dev transfer, causing a NULL pointer dereferenc...

CVE-2026-93114

A flaw was found in the Linux kernel. A vulnerability exists in the platform/surface: acpi-notify component where a platform driver can be forced to match a device lacking an ACPI companion object. This can lead to a NULL pointer dereference when the sanprobe function attempts to access a...

CVE-2026-93107

A flaw was found in the Linux kernel's RDMA/rxe component. When a Queue Pair QP transitions to an error state during packet completion, the system may reprocess an already-completed packet. This can lead to duplicate data being delivered to user applications, causing data stream corruption...

CVE-2026-93073

A flaw was found in the Linux kernel's Direct Access DAX subsystem. A race condition in the daxholdernotifyfailure function allows a concurrent operation to clear a critical pointer holderops between two reads. This can lead to a null pointer dereference, potentially enabling a local attacker to...

CVE-2026-93050

A flaw was found in the Linux kernel's ipack: ipoctal module. This vulnerability arises from improper memory handling, specifically Use-After-Free UAF conditions and a NULL pointer dereference, when the device is removed while a terminal tty session is still active. A local attacker could exploit...

CVE-2026-80917

A flaw was found in the Linux kernel's PCI host-generic component. On 32-bit systems utilizing the "pci-host-cam-generic" driver, a missing bus mapping setup during Peripheral Component Interconnect PCI configuration can lead to a NULL pointer dereference. This vulnerability can be triggered duri...

CVE-2026-92492

A flaw was found in the Linux kernel's cpufreq/amd-pstate component. A local attacker could potentially trigger a NULL pointer dereference by performing a racing CPU hotplug or driver teardown operation. This occurs because certain functions, amdpstatepowersupplynotifier and amdpstateprofileset, ...

CVE-2026-92479

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver. When an invalid completion queue entry CQE tag is reported, the driver attempts to dereference a NULL pointer, which can lead to a system crash. This vulnerability could allow a local attacker to cause a...

CVE-2026-90405

A flaw was found in the media: stm32: dcmi component of the Linux kernel. Improper error handling in the probe function can lead to a null pointer dereference. This issue occurs because dmareleasechannel is called before the dcmi-dmachan variable is properly assigned, potentially allowing a local...

CVE-2026-90400

A flaw was found in the Linux kernel's Multiple Device MD driver. A race condition exists where the system may attempt to remove or replace RAID array devices while they are still actively being used for input/output operations. This can lead to a null pointer dereference, causing the system to...

CVE-2026-90397

A flaw was found in the Linux kernel's Qualcomm qcom Secure Channel Manager SCM firmware component. This vulnerability allows for a NULL pointer dereference due to improper initialization of a shared memory pointer. An attacker could exploit this timing issue, potentially leading to a system cras...

CVE-2026-90374

A flaw was found in the Linux kernel's mt76 wifi driver. This vulnerability occurs due to improper validation of the bandidx field, which is used to index an array. A malicious actor could provide a corrupt or reserved descriptor value, leading to an out-of-bounds access or a NULL pointer...

CVE-2026-98476

A flaw was found in the Linux kernel's s390 channel I/O CIO subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could exploit this condition during hardware reconfiguration,...