EUVD-2026-67787

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The webradiusSrvpost family of handlers copies the radKey, radKey0, radDftParamKey, radName, and radIp POST parameters into...

CVE-2026-75125 PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The webpoealivermtippost handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted...

CVE-2026-75125 PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The webpoealivermtippost handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted...

CVE-2026-75125

PLANET GS-4210-16P2S managed PoE switches running firmware before 3.441b260626 are affected by an authenticated null pointer dereference in /cgi-bin/dispatcher.cgi. Specifically, the web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without checking for its presence. A remote auth...

EUVD-2026-67785

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The webpoealivermtippost handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted reque...

CVE-2026-38344

A flaw was found in FFmpeg. This vulnerability involves a NULL pointer dereference within the getminbuffersize function when processing specially crafted video files. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service DoS. A Denial of Service attack...

CVE-2026-80697

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

AZL-98072 CVE-2026-80691 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

AZL-98175 CVE-2026-80689 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

AZL-98081 CVE-2026-80678 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

AZL-98156 CVE-2026-80679 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2cimxregslave, the slave pointer was assigned before pmruntimeresumeandget. If pmruntimeresumeandget failed, the error path returned without clearing i2cimx-slave,...

CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...