CVE-2026-93261: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

CVE-2026-93825

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

PT-2026-98050

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Running a btrfs balance operation can trigger a null-pointer dereference when metadata corruption causes a chunk in the chunk tree to exist without a corresponding block group in the...

PT-2026-98080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the ACPICA component. The function acpi ns custom package unconditionally dereferences the first element of a package to read the BIX version number...

CVE-2026-93286: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

PT-2026-97930

Name of the Vulnerable Software and Affected Versions OpenEXR version 3.4.14 Description A NULL Pointer Dereference occurs in the C++ attribute parsing path. When processing a specially crafted EXR file containing an unknown-type attribute where the dataSize is set to zero, the parser creates an...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

PT-2026-104969

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, get tgt name returns ERR PTR-ENOENT when ce-tgthint is NULL, and dfs cache noreq update tgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

PT-2026-104879

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup snd es18xx mixer creates controls with snd ctl new1 and then stores bookkeeping pointers or sets private free before calling snd ctl add. snd ctl new1 can return NU...

PT-2026-104953

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: goku udc: avoid NULL deref of dev-driver in INT USBRESET log goku irq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

Linux kernel security vulnerabilities

A security vulnerability exists in the Linux kernel; it stems from nvme-fc canceling requests prior to initializing an io tagset, which may lead to null pointer dereferencing...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

CVE-2026-97519

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

CVE-2026-97513: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

PT-2026-104982

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xe devcoredump snapshot free, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the xe guc...

PT-2026-98132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free issue exists in the wave5 media component. A null pointer dereference occurs if an IRQ thread obtains a spinlock between the release of m2m ctx and the removal of the...

PT-2026-98138

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists during the devcoredump cleanup process. In the xe devcoredump snapshot free function, the ss-gt variable may be NULL if the snapshot was not fully...