CVE-2026-74610

CVE-2026-74610 is a kernel NULL pointer dereference in the Linux kernel TLS subsystem (tls_sw_sendmsg_locked). When the copy path fills the plaintext sk_msg ring, it fails to set full_record, leaving the record full and unpushed. A subsequent splice() call then writes into the already-full ring; ...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...

PT-2026-79737

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110 set avmute Some older DCE timing generators do not implement is tg enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereferen...

PT-2026-79707

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost scsi setup vq cmds runs from VHOST SCSI SET ENDPOINT and allocates each command's protection scatterlist array prot sgl according to the acknowledged VIRTIO SCSI F T10 PI bi...

PT-2026-79638

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event mod-match when foo has not been loaded. If a later write tries to remove a specific mat...

PT-2026-79592

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip last asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp asconf queue teardown...

PT-2026-79733

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b addr in xfs buf free When xfs buf alloc backing mem fails, xfs buf free is called with bp-b addr still NULL. The code falls through to the folio put path which calls virt to folioNULL, dereferencing an invalid...

PT-2026-79659

In the Linux kernel, the following vulnerability has been resolved: serial: 8250 dma: Clear stale RX state on shutdown serial8250 release dma terminates RX DMA and releases the channel, but leaves rx running set. If the port is closed while an RX transfer is active, the stale state remains while...

Linux Distros Unpatched Vulnerability : CVE-2026-74732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionall...

PT-2026-79711

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr dev fails during auxiliary device setup, the error path calls auxiliary device uninit, which eventually invokes bnge aux dev release. The release...

Linux Distros Unpatched Vulnerability : CVE-2026-74726

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via...

PT-2026-79615

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk msg ring unpushed When the copy path in tls sw sendmsg locked adds the fragment that fills the plaintext sk msg ring, it does not set full record, so the record is left full and unpushed. A...

Linux Distros Unpatched Vulnerability : CVE-2026-74610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does no...

PT-2026-79731

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary is promisc under RTNL in bond alb monitor bond alb monitor reads primary is promisc under RCU, then drops RCU and takes RTNL via rtnl trylock before undoing the promiscuity it set on the active slav...

PT-2026-79689

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tap get user xdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in dev parse header protocol when skb-dev is null" fixed a crash in tap get user by assigning...

CVE-2026-56288

A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of end-of-file markers can corrupt internal data structures, causing the utility to crash. This results in a denial of service...

CVE-2026-50812

A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17251

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of the TP-Link TL-MR6400 v7 router. An unauthenticated attacker on the adjacent network can trigger the flaw by sending a crafted HTTP request containing a malformed session cookie header , causing the HTTP ...