edk2 security, bug fix, and enhancement update

20251114-5.0.1.el102.2 - Replace upstream references Orabug:36569119 20251114-5.el102.2 - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch RHEL-182421 - edk2-Bumped-to-OpenSSL-3.5.5-3.patch RHEL-165699 - Resolves: RHEL-182421 edk2/x64: re-enable legacy kernel loader rhel-10.2.z -...

kernel security update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

CVE-2026-62299: NULL Pointer Dereference

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...

CVE-2026-62309: NULL Pointer Dereference

CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11,...

openSUSE 16 Security Update : patch (openSUSE-SU-2026:21332-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21332-1 advisory. This update for patch fixes the following issues - CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence bsc1271167. ...

JLSEC-2026-765 Remote packet capture support is disabled by default in libpcap

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcapfindalldevsex. One of the function arguments can be a filesystem path, which normally means a directory with...

kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...

Security update for patch (low)

openSUSE security update: security update for patch ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21332-1 Rating: low References: bsc1271166 bsc1271167 Cross-References: CVE-2026-56288 CVE-2026-56289 CVSS scores: CVE-2026-56288 SUSE : 3.3...

CVE-2026-52865: NULL Pointer Dereference

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane...

WatchGuard FireWare OS iked ike2_hmac Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability, but only systems using VPN with IKEv2 are vulnerable. The specific flaw exists within the handling ...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

EUVD-2026-44129

Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally...

EUVD-2026-43903

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...

EUVD-2026-43882

Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...

EUVD-2026-43761

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...

CVE-2026-56168

Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network...

CVE-2026-50673

Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-50366

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...

CVE-2026-50315

Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...

USN-8526-2 libheif vulnerabilities

USN-8526-1 fixed vulnerabilities in libheif. This update provides the corresponding updates for CVE-2026-47709 and CVE-2026-47714 in Ubuntu 24.04 LTS. Original advisory details: Junyi Liu discovered that libheif had a null pointer dereference in its image tiling interface. An attacker could...