CVE-2026-80846

A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This can lead to a system crash, resulting in a Denial of Service...

CVE-2026-80819

A flaw was found in the Bluetooth RFCOMM Radio Frequency Communication subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect DISC message to a device with a deferred RFCOMM channel. This can lead to a null pointer dereference when the system attempts t...

CVE-2026-80817

A flaw was found in the Linux kernel's iommu/iommufd component. A local user could exploit a race condition during the processing of I/O address space IOAS areas. This vulnerability occurs when iommufdioaschangeprocess attempts to access an IOAS area before its pages are fully mapped, leading to ...

CVE-2026-80813

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmetexecuteidentifynslist function by issuing a specific Identify command CNS 07h. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...

CVE-2026-80771

A flaw was found in the Linux kernel's Nintendo Joy-Con driver. A local attacker could potentially trigger a null pointer dereference by sending a concurrent force-feedback FFRUMBLE command while the device is being registered. This could lead to a system crash, resulting in a Denial of Service D...

CVE-2026-80756

A flaw was found in the SELinux subsystem of the Linux kernel. A local attacker could trigger a null pointer dereference by attempting to load a policy when no old policy exists and the policy conversion fails. This issue, reachable through a write operation to /sys/fs/selinux/load, could lead to...

SUSE CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

SUSE CVE-2026-113680

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2026-76492 Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

EUVD-2026-107351

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

CVE-2026-76492

The Cisco Expressway Series software is affected by NULL Pointer Dereference vulnerabilities (CWE-476) identified during an internal security review. These vulnerabilities are addressed in the October 2026 Software Hardening Release . The issue carries a HIGH severity rating (CVSS 3.1 score of 7....

CVE-2025-60469

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2026-90039

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities could trigger a null pointer dereference by attempting to unlock a filesystem or export via specific netlink commands before the NFSD internal tables are fully initialized...

CVE-2026-90023

A flaw was found in the Linux kernel's USB mass storage gadget function. An attacker could exploit this by providing a specially crafted input that sets the number of buffers to an invalid value, such as zero or one. This bypasses intended restrictions and leads to a null pointer dereference. The...

CVE-2026-89993

A flaw was found in the Linux kernel's dmaengine: dw-edma driver. A local attacker could exploit a timing issue where interrupt data is not fully initialized before an interrupt is requested. This could lead to a NULL pointer dereference when a shared interrupt handler is invoked, causing the...

CVE-2026-90020

A flaw was found in the Linux kernel's USB gadget subsystem. A race condition in the gadgetdevioctl function, where a pointer is read before a lock is acquired, can lead to a null pointer dereference. A local attacker could exploit this timing issue during a concurrent bind operation, potentially...

CVE-2026-89966

A flaw was found in the Linux kernel's huge page memory management mm/hugetlbcma. An unprivileged local user could trigger a null pointer dereference. This occurs by requesting a gigantic hugepage allocation with specific memory policy settings on systems where the Contiguous Memory Allocator CMA...

CVE-2026-89963

A flaw was found in the Linux kernel's powerpc/kexecfile component. On systems configured without reserved memory regions, a NULL pointer dereference can occur in the kexecextrafdtsizeppc64 function during extra size calculation. This can lead to a kernel panic, effectively causing a denial of...

CVE-2026-89933

A flaw was found in the Linux kernel's dps310 pressure sensor driver. When a device is enumerated using its ACPI Hardware ID HID, the driver may attempt to dereference a null pointer. This occurs because the ACPI-derived client name does not match the driver's device ID table, causing a critical...

CVE-2026-89884

A flaw was found in the Linux kernel's mtk-mdp3 media driver. A missing sanity check when looking up the System Control Processor SCP can lead to a NULL pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service DoS...