CVE-2026-97975

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth hci_sysfs component. A race condition exists between hci_conn_del_sysfs() and concurrent child device unregistration (such as a BNEP network device calling unregister_netdev()). During unregistration, device_del()...

EUVD-2026-86629

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97947 x86/amd_node: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

EUVD-2026-86801

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97947

The Linux kernel contains a vulnerability in the x86/amd_node component where amd_smn_read() and amd_smn_write() functions could trigger a NULL pointer dereference . This occurs because these functions are exported around __amd_smn_rw(), making them accessible even if amd_smn_init() fails. In suc...

CVE-2026-97947

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97932

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed. Keep the...

CVE-2026-97601 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-97601 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

EUVD-2026-86732

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-97593

The Linux kernel contains a NULL pointer dereference vulnerability in the iommu/s390 component. When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX , the function get_rto_from_iova() fails to verify if the region-second origin rso is non-NULL before accessing rso[rsx] . This occurs bec...

EUVD-2026-86901

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

CVE-2026-97593 iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

EUVD-2026-86878

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97570 bnxt_en: Bound SW TPA IDs to prevent crashes

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97570

The Linux kernel contains a vulnerability in the bnxt_en driver where 57608 NICs with firmware version 233 can experience a crash at boot . The issue arises because the bnxt_alloc_agg_idx function can produce a software ID exceeding the 32 entries allocated for rx_tpa, leading to an out-of-bounds...

CVE-2026-97537

The Linux kernel contains a vulnerability in the scsi qla2xxx driver within the qla25xx_free_req_que() and qla25xx_free_rsp_que() functions. Two specific issues occur on the error path of queue creation: first, an unconditional dma_free_coherent() call with a NULL pointer (resulting from a dma_al...

EUVD-2026-86845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...