EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-88389

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

PT-2026-98706

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg not null decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NU...

CVE-2026-88389: NULL Pointer Dereference

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

PT-2026-98701

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcount acquire nullable for borrowed RCU kptrs bpf refcount acquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF RET NULL on the return valu...

PT-2026-98726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the btf var show function. This occurs because the function calls btf type id resolve unconditionally, which attempts to dereference btf-resolved ids...

CVE-2026-98037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

PT-2026-98600

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parse field sets HIST FIELD FL STACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolv...

PT-2026-98791

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the mpi3mr sas port add function. This happens because the sas port alloc num function can return NULL during a memory allocation failure, and this...

CVE-2026-98086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

PT-2026-98749

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA Advanced Linux Sound Architecture UMP component where the snd ump parse endpoint function sets the ump-parsed flag upon exit, including during error states,...

CVE-2026-98008: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-98059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-98064: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

PT-2026-98541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the lowpan newlink function. This occurs because TUNSETLINK allows a TUN device to change its link-layer type to ARPHRD IEEE802154 without initializi...

CVE-2026-97601: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-98129: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

PT-2026-98690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the mv88e6xxx get rxnfc function within the net: dsa: mv88e6xxx module. The function uses rxnfc-rule cnt as a write index when dumping the policy IDR, which overwrites t...

PT-2026-98722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the sched process wait tracepoint does not correctly mark its first argument as nullable. When do wait passes wo-wo pid ...

CVE-2026-97936

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...