Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If “dmkvzallocpercpuallocsize, cputonodecpu” fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree does “foreachpossiblecpucpu...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE — once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable BUG There is a bug report indicating that btrfs/242 may randomly fail due to a NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. Currently, fcpfindfcinterface selects the first vendor-specific interfac...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. An example is a table that advertizes one optional argument but provides only a recognized option name, such as...

CVE-2026-99257

A flaw was found in the Linux kernel's General Purpose Input/Output GPIO subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the operating system. The issue occurs during shared GPIO lookups using firmware nodes without an associated device, resulting in...

PT-2026-138392

Name of the Vulnerable Software and Affected Versions Babelfish for PostgreSQL versions 1.0 through 1.5 Babelfish for PostgreSQL versions 2.1 through 2.15 Babelfish for PostgreSQL versions 3.1 through 3.12 Babelfish for PostgreSQL versions 4.0 through 4.8 Babelfish for PostgreSQL versions 5.1...

Elastic Beats packetbeat 8.0.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-208)

The version of Elastic Beats packetbeat installed on the remote host is 8.0.x prior to 8.19.24, 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a denial of service vulnerability. - NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to ...

CVE-2026-87045: zephyrproject zephyr: The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of…

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

mod_auth_openidc:2.3 security and bug fix update

An update is available for module.cjose, cjose, module.modauthopenidc, modauthopenidc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

Updated znc package fixes security vulnerabilities

Updated the old bundled vulnerable version of jQuery to 3.5.1. CVE-2020-11022 Use-after-free when unloading modules, triggered by unprivileged users. CVE-2026-82373 Null pointer dereference in crypt module, triggered by IRC server. CVE-2026-82374...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

Qnap QTS / QuTS hero NULL Pointer Dereference (CVE-2025-47213)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150491 advisory. Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

SUSE-SU-2026:5099-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed bsc1284043. - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to creat...

SUSE CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...