Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is found in riscv’s machinekexecprepare, where image-segmenti.buf may be NULL and is copied without any checks. The NULL buf originat...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable BUG There is a bug report indicating that btrfs/242 may randomly fail due to a NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that does not match its list of device IDs due to devicematchdriveroverride, platform drivers that rely on...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE — once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If “dmkvzallocpercpuallocsize, cputonodecpu” fails, the code jumps to the “out” label and calls dmstatfree. dmstatfree does “foreachpossiblecpucpu...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging Similar to other parts of the code, getssinfofromatombios utilizes calcpllcs-ctx-logger for logging. However, calcpllcs-ctx is only initialized later within calcpllmaxvcoconstruct...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

CVE-2026-99257

A flaw was found in the Linux kernel's General Purpose Input/Output GPIO subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the operating system. The issue occurs during shared GPIO lookups using firmware nodes without an associated device, resulting in...

CVE-2026-63686

ACW3 — CVE-2026-63686 Apache modxml2enc DoS Target environment and demo material for INF2005 ACW3: a NULL pointer dereference in modxml2enc Apache HTTP Server ≤ 2.4.68, fixed in 2.4.69 triggered by a proxied response whose charset conversion partially succeeds, then fails. CVSS 7.5 High — denial ...

PT-2026-138392

Name of the Vulnerable Software and Affected Versions Babelfish for PostgreSQL versions 1.0 through 1.5 Babelfish for PostgreSQL versions 2.1 through 2.15 Babelfish for PostgreSQL versions 3.1 through 3.12 Babelfish for PostgreSQL versions 4.0 through 4.8 Babelfish for PostgreSQL versions 5.1...

Elastic Beats packetbeat 8.0.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-208)

The version of Elastic Beats packetbeat installed on the remote host is 8.0.x prior to 8.19.24, 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a denial of service vulnerability. - NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to ...

CVE-2026-87045: zephyrproject zephyr: The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of…

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge function fails to properly validate the first input band, allowing...

mod_auth_openidc:2.3 security and bug fix update

An update is available for cjose, modauthopenidc, module.cjose, module.modauthopenidc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

Updated znc package fixes security vulnerabilities

Updated the old bundled vulnerable version of jQuery to 3.5.1. CVE-2020-11022 Use-after-free when unloading modules, triggered by unprivileged users. CVE-2026-82373 Null pointer dereference in crypt module, triggered by IRC server. CVE-2026-82374...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

Qnap QTS / QuTS hero NULL Pointer Dereference (CVE-2025-47213)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...