CVE-2026-93236

The Linux kernel contains a NULL pointer dereference vulnerability within the media: meson: vdec component. When the VIDIOC_TRY_FMT command is invoked with an unsupported pixel format on the OUTPUT queue , the function vdec_try_fmt_common() attempts to fall back to V4L2_PIX_FMT_MPEG2 . In distrib...

CVE-2026-93236 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

EUVD-2026-86241

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

CVE-2026-93212 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

EUVD-2026-85941

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93210 smb: client: harden DFS cache against invalid target hints

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

CVE-2026-93210 smb: client: harden DFS cache against invalid target hints

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

EUVD-2026-85939

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: SCTP: Stream: Fully roll back denied add-stream states When the request to add a stream ADDOUTSTREAMS is denied, SCTP only reduces the size of the queued chunks and lowers the outcnt value. This leaves the removed stream’s metada...

OPENSUSE-SU-2026:21950-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check bsc1273133. - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remot...

SUSE-SU-2026:23916-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check bsc1273133. - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remot...

CLSA-2026-1790065872 freerdp: Fix of 2 CVEs

CVE-2026-67291: fix heap out-of-bounds read in updateprocessglyphfragments; reject a GLYPHFRAGMENTADD update whose one-byte server-declared fragment size exceeds the bytes remaining in the received order buffer, instead of passing it straight to glyphcachefragmentput which copies that many bytes...

CLSA-2026-1790172301 nginx: Fix of 3 CVEs

CVE-2026-27651: fix null pointer dereference in ngxmailauthhttpmodule when clearing the password in auth http requests with CRAM-MD5/APOP - CVE-2026-27654: fix heap buffer overflow in ngxhttpdavmodule when a COPY/MOVE destination URI is shorter than the location alias - CVE-2026-27654: also...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...