CVE-2026-74702

A flaw was found in the vhost-scsi component of the Linux kernel. This vulnerability allows a local attacker to cause a denial of service DoS by changing virtio feature bits after the vhost-scsi endpoint has been activated. Specifically, enabling the T10-PI feature after setup can lead to an...

CVE-2026-74684

A flaw was found in the Linux kernel's net: tap module. A NULL pointer dereference can occur in the tapgetuserxdp function when processing an XDP buffer with a GSO virtio-net header and a zero protocol. This can be triggered by a malicious guest in a virtualized environment, leading to a system...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-71922

Multiple DrayTek VigorSwitch models are affected by a pre-authentication null pointer dereference in the setget.cgi interface. The root cause is missing validation when the pass field is absent from a request, allowing a remote unauthenticated attacker to crash the service via a crafted request, ...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

EUVD-2026-64981

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

EUVD-2026-64979

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920

DrayTek VigorSwitch (multiple models) contains a null pointer dereference in the formlogout function caused by missing validation of the Cookie header before string handling. A remote attacker with valid administrative credentials on the web management interface can send a crafted request to cras...

JLSEC-2026-1386

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

CVE-2026-74610

A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...

CVE-2026-74732

A flaw was found in the Linux kernel's AMD display drm/amd/display driver. When a user turns off the display over HDMI on systems with older DCE timing generators, the driver attempts to call a function istgenabled that may not be implemented. This unconditional call can lead to a NULL pointer...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Binder: Fixed the issue where dereferencing the null-ptr variable occurred unexpectedly. Syzbot reported several issues introduced by commit 44e602b4e52f „binderalloc: added missing mmaplock calls when using VMA”. In these...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dma-fence: Fixed the potential issue of dereferencing a null pointer in tracedmafinesignaled, tracedmafinewaitend, and tracedmafinedestroy. After the fence signalling is reset, a null fence-ops pointer may be dereferenced. We...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fixed a NULL pointer dereference in pnfsmarkmatchinglsegsreturn. The commit de144ff4234f fixes the issue by changing pnfsreturnlayout to call pnfsmarkmatchinglsegsreturn, with NULL passed as the argument to the...