Linux Distros Unpatched Vulnerability : CVE-2026-109679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers...

CVE-2026-31431

CVE-2026-31431 — From a NULL Pointer to Root: Exploiting AFALG AEAD in the Linux Kernel Bug class: Null pointer dereference → heap OOB write → credential overwrite Affected subsystem: net/alg/afalg.c Impact: Local Privilege Escalation unprivileged user → root Affected kernels: Linux 4.4 – 4.9...

SUSE CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

SUSE CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

SUSE CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

practice-22-23

Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...

CVE-2026-113680

A flaw was found in HarfBuzz. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying a specially crafted font containing an embedded WebAssembly Wasm module. When an application shapes text using the malicious font, the module passes out-of-range memory addresses to...

CVE-2026-64593

A flaw was found in the btrfs filesystem of the Linux kernel. A local user could trigger a system crash by attempting to perform a trim operation on a storage device that was previously unavailable but has since reconnected and is not writeable. This issue arises from a synchronization problem...

CVE-2026-87117

A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service DoS by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users...

CVE-2026-23398

CVE-2026-23398 Linux Kernel icmptagvalidation NULL Pointer Dereference Remote DoS Description icmptagvalidation in net/ipv4/icmp.c dereferences inetprotosproto without a NULL check. A remote attacker can send a single crafted ICMP Fragmentation Needed packet with an unregistered inner protocol...

CVE-2026-89784

A flaw was found in the Linux kernel's SUNRPC component. When an in-kernel RPC service registers with the local rpcbind under memory pressure, a failure in memory allocation can lead to a NULL pointer being dereferenced. This unchecked NULL pointer can cause the kernel to crash, resulting in a...

CVE-2026-80912

A flaw was found in the Linux kernel's SELinux subsystem. When processing security class values, the securitygetclasses function could return a null pointer if a class value was not properly defined by the security policy. This could lead to a null pointer dereference, potentially causing a syste...

CVE-2026-80730

A flaw was found in the Linux kernel. The ring-buffer component's cleanup routine can incorrectly attempt to stop a kernel thread using an invalid error pointer. This happens when kthreadrunoncpu fails, storing an error pointer in the rbthreads array. Calling kthreadstop on this invalid pointer...

CVE-2026-97605

A flaw was found in the Linux kernel. When resizing the decompression stream pool in the Enhanced Read-Only File System EROFS encounters a memory allocation failure, an uninitialized stream is improperly retained in the active pool. A local user accessing or decompressing an affected filesystem c...

CVE-2026-93212

A flaw was found in the Linux kernel NFS daemon nfsd. During network teardown, the nfsdserv pointer is prematurely cleared while the file cache cleanup process is still active. This can lead to a null pointer dereference in the nfsdfilenetdispose function. Exploiting this vulnerability could caus...

CVE-2026-93210

A flaw was found in the Linux kernel's Server Message Block SMB client Distributed File System DFS cache. This vulnerability occurs due to improper handling of invalid target hints, specifically when a null pointer is dereferenced within the dfscachenorequpdatetgthint function. An attacker could...

CVE-2026-90019

A flaw was found in the Linux kernel. A null pointer dereference can occur in the usbputfunctioninstance function within the USB gadget subsystem. This issue arises because a file descriptor fd is not allocated before being dereferenced in an error path, which can lead to a system crash. A local...

CVE-2026-89955

A flaw was found in the s390/vfio-ap component of the Linux kernel. A local attacker could exploit a race condition during the queue probing process. This occurs when a concurrent read of the 'status' attribute happens before the necessary driver data is initialized, leading to a NULL pointer...

CVE-2026-89958

A flaw was found in the Linux kernel's s390/vfio-ap component. Within the call stack of specific callback functions, a mutex is acquired without properly checking if a critical pointer matrixmdev-kvm is initialized. If this pointer is NULL, attempting to access it will trigger a NULL pointer...

CVE-2026-89874

A flaw was found in the Linux kernel's v4l2-async media subsystem. When creating ancillary media links, the v4l2asyncmatchnotify function attempts to delete an unlinked entry if the link creation fails. This can lead to a null pointer dereference, potentially causing a system crash. A local...