101734 matches found
CVE-2026-98098
A NULL pointer dereference exists in the Linux kernel 's TIPC (Transparent Inter-Process Communication) protocol. The vulnerability occurs in tipc_named_node_up() when the number of local publications exceeds TIPC_MAX_PUBL (65535). Under these conditions, protocol service types are not inserted i...
CVE-2026-98098
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...
EUVD-2026-86928
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...
CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...
EUVD-2026-86916
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...
CVE-2026-98086
The Linux kernel contains a vulnerability in the ALSA subsystem related to the UMP component. The function snd_ump_parse_endpoint() incorrectly sets ump->parsed on every exit, including errors, before the legacy rawmidi device is attached. Consequently, ump_handle_ep_name_msg() may treat parse...
CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...
EUVD-2026-86718
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...
CVE-2026-98065 bpf: Reject key-less BTF for hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...
CVE-2026-98065
The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...
CVE-2026-98065 bpf: Reject key-less BTF for hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...
CVE-2026-98064 bpf: Fix NULL-ptr-deref when showing a void BTF type
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...
CVE-2026-98063
The Linux kernel contains a NULL pointer dereference vulnerability in the btf_var_show() function. The issue occurs because btf_var_show() unconditionally calls btf_type_id_resolve() , which dereferences btf->resolved_ids . This pointer is NULL for base BTF structures, such as the vmlinux BTF ...
EUVD-2026-86716
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...
CVE-2026-98064 bpf: Fix NULL-ptr-deref when showing a void BTF type
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...
CVE-2026-98063 bpf: Fix NULL-ptr-deref in btf_var_show()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...
CVE-2026-98063 bpf: Fix NULL-ptr-deref in btf_var_show()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...
EUVD-2026-86717
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...
CVE-2026-98064
The Linux kernel contains a NULL-pointer dereference vulnerability within the BPF subsystem. The issue occurs in btf_modifier_show() when it attempts to call the show() operation on a void type (type_id 0, BTF_KIND_UNKN). Because the kind_ops[] array lacks an entry for this type, the pointer is N...
CVE-2026-98064
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...