CVE-2026-87045 NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

K000164139: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-53016 In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AFALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccpaescomplete restores AESBLOCKSIZE bytes into the caller's IV buffer...

CVE-2026-120454

A flaw was found in sleuthkit. An attacker can cause a Denial of Service DoS by providing a specially crafted HFS+ filesystem image with an excessively large uncompressed attribute size. When sleuthkit attempts to decompress the data, a memory allocation failure triggers a null pointer dereferenc...

CVE-2026-96432

A flaw was found in Qt. A malicious or compromised HTTP/2 server can trigger a Denial of Service DoS against client applications by sending specific stream frames out of sequence while withholding settings acknowledgments. This improper handling induces a null pointer dereference within the Qt...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexecfile: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexecextrafdtsizeppc64. On platforms without any reserved memory regions,...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent via mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules an...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: FireWire: OHCI – fix NULL pointer dereference in arcontextrelease During the error-handling path of the driver’s probe function, a NULL pointer dereference may occur in arcontextrelease. When pciprobe fails early for example, if...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: afs: Fixed missing NULL pointer check in afsbreaksomecallbacks Fixed afsbreaksomecallbacks to check whether afslookupvolumercu returned NULL i.e., the specified volume is unknown...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: fix NULL pointer dereference in qcadmphdr for non-serdev device For hciuart attached via non-serdev paths, hu-serdev is NULL; however, qcadmphdr unconditionally dereferences hu-serdev-dev.driver-name, resulting...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues such as kernel...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. This value is NULL for a base BTF—for example, the vmlinux BTF rendered by bpfsnprintfbtf—since the ba...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreqsuspend is called via the kernelrestart - deviceshutdown path. Unlike the normal system suspend path, the reboot path does not call freezeprocesses, so...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including those that were never allocated by the setup loop following a partial failure, resulti...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vcdata fbconnewmodelist is called whenever the modelist of a framebuffer changes. For each console mapped to it via fbdisplayi.mode, it reads vcconsi.d and passes the vcnu...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594regulatorprobe, the multi-phase configuration loop calls offindnodebyname to find buck nodes by name, and ofgetparent twice to navigate to the PMIC...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata may return NULL if a VHCI host controller’s probe fails e.g., due to an exhausted USB bus number. statusshowvhci checks for a NULL pdev but does not check for a...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then unconditionally calls btftypeopst-show. For the void type typeid 0, BTFKINDUNKN, there is no entry in kindops, so -show returns...