CVE-2026-93274: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

CVE-2026-93273: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594regulatorprobe, the multi-phase configuration loop calls offindnodebyname to find buck nodes by name, and ofgetparent twice to navigate to the PMIC...

CVE-2026-93236: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

CVE-2026-88373: NULL Pointer Dereference

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

PT-2026-105007

In the Linux kernel, the following vulnerability has been resolved: usbip: vhci hcd: fix NULL deref in status show vhci platform get drvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. status show vhci checked for a NULL pdev but not for a NULL...

PT-2026-98135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the rtw fw adaptivity result function within fw.c of the rtw88 wifi driver. The issue occurs because devices using the 8821CE chip do not define the...

PT-2026-98048

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference can occur in the ASOC mediatek mt8365-afe-pcm component. The function mt8365 afe suspend uses devm kcalloc to allocate a register backup buffer but fails to...

PT-2026-98065

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs when the dc update planes and stream function is called separately for a stream and its associated phantom stream. This happens because the phantom stre...

PT-2026-98121

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the mmc davinci irq function within the Linux kernel. The issue occurs because the function only returns early when both host-cmd and host-data are...

PT-2026-104928

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host-data in IRQ handler mmc davinci irq returns early only when both host-cmd and host-data are NULL: if host-cmd == NULL && host-data == NULL ... return IRQ NONE; So we may legitimately reach t...

PT-2026-104889

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp send ddp aarp send ddp calls atalk find dev addrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalk ptr ==...

CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

CVE-2026-93263

In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clkinitdata eswinclkregisterpll and eswinregisterclkdiv declare a struct clkinitdata on the stack and only initialize some of its fields parentdata respectively parenthws...

CVE-2026-93261

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

CVE-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...

CVE-2026-97513

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

PT-2026-98132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free issue exists in the wave5 media component. A null pointer dereference occurs if an IRQ thread obtains a spinlock between the release of m2m ctx and the removal of the...

PT-2026-97950

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the functions eswin clk register pll and eswin register clkdiv declare a clk init data structure on the stack but only initialize specific fields, namely parent data...