CVE-2026-89958

A flaw was found in the Linux kernel's s390/vfio-ap component. Within the call stack of specific callback functions, a mutex is acquired without properly checking if a critical pointer matrixmdev-kvm is initialized. If this pointer is NULL, attempting to access it will trigger a NULL pointer...

CVE-2026-89874

A flaw was found in the Linux kernel's v4l2-async media subsystem. When creating ancillary media links, the v4l2asyncmatchnotify function attempts to delete an unlinked entry if the link creation fails. This can lead to a null pointer dereference, potentially causing a system crash. A local...

CVE-2026-89851

A flaw was found in the Linux kernel's qla2xxx SCSI driver. An issue in the qla2x00dfsfcewrite function, responsible for parsing Fibre Channel over Ethernet FCE trace enable settings in debugfs, could lead to a null pointer dereference. A local attacker with access to debugfs could trigger this...

CVE-2026-89822

A flaw was found in the Linux kernel's drm/i915 module. A local user could exploit a null pointer dereference in the i915pciprobe function. This occurs when a device is force-bound via sysfs driveroverride, causing driverdata to be NULL and subsequently dereferenced. Successful exploitation could...

CVE-2026-89809

A flaw was found in the drm/amdkfd component of the Linux kernel. A local user can trigger a system crash by reading the /sys/kernel/debug/kfd/mqds file while a process holds an active Kernel Fusion Driver KFD queue. This issue arises from a NULL pointer dereference, where a critical variable is...

CVE-2026-90156

A flaw was found in ksmbd, a component of the Linux kernel. When handling deferred locks, a failure in setting up asynchronous work can lead to a null pointer dereference and the continued linking of a freed file lock. This memory corruption issue can cause a system crash, resulting in a denial o...

CVE-2026-113680

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

EUVD-2026-105096

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2026-113680

The HarfBuzz library, versions 8.0.0 through 14.6.0 , contains a NULL pointer dereference vulnerability within the experimental WebAssembly shaper host imports, specifically affecting buffer_set_contents, face_create, and font_set_coords. A remote attacker can trigger a Denial of Service (DoS) by...

CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. This driver is very old and is not loaded by default on my test machine, so I will exploit it in a BYOVD scenario. Interestingly, according to my research this driver has existed on Windows 7 and has at least one bug. here At that time, MSRC didn't take any...

CVE-2026-93124

A flaw was found in the Linux kernel's asus-wireless driver. When the driver is force-bound to a device lacking an ACPI Advanced Configuration and Power Interface companion object, it can lead to a NULL pointer dereference. This occurs because the asuswirelessprobe function incorrectly stores a...

CVE-2026-93180

A flaw was found in the panthor component of the Linux kernel. A local attacker could exploit this vulnerability by performing a partial unmap of an evicted Buffer Object BO when the Graphics Processing Unit GPU mapping is split. This occurs because the logic for handling partial unmap of huge...

CVE-2026-93139

A flaw was found in the AMDGPU driver within the Linux kernel. An issue with the hungqueuedbarray loop limit for multi-XCC Cross-Chiplet Interconnect GPUs can leave array entries uninitialized. This can lead to a null pointer dereference when accessing arrays indexed by XCC ID greater than or equ...

CVE-2026-93115

A flaw was found in the Linux kernel's Mellanox mlxbf-pmc driver. A local attacker could exploit this by forcing the driver to bind to a device lacking an ACPI Advanced Configuration and Power Interface companion object. This action triggers a NULL pointer dereference, which can lead to a system...

CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer...

CVE-2026-93068

A flaw was found in the Linux kernel's AMD display DM I2C adapter. A race condition exists where the DM I2C adapters remain visible to userspace while the DM teardown is in progress. A local attacker could exploit this by initiating a concurrent i2c-dev transfer, causing a NULL pointer dereferenc...

CVE-2026-93114

A flaw was found in the Linux kernel. A vulnerability exists in the platform/surface: acpi-notify component where a platform driver can be forced to match a device lacking an ACPI companion object. This can lead to a NULL pointer dereference when the sanprobe function attempts to access a...

CVE-2026-93107

A flaw was found in the Linux kernel's RDMA/rxe component. When a Queue Pair QP transitions to an error state during packet completion, the system may reprocess an already-completed packet. This can lead to duplicate data being delivered to user applications, causing data stream corruption...