CVE-2026-97537

The Linux kernel contains a vulnerability in the scsi qla2xxx driver within the qla25xx_free_req_que() and qla25xx_free_rsp_que() functions. Two specific issues occur on the error path of queue creation: first, an unconditional dma_free_coherent() call with a NULL pointer (resulting from a dma_al...

EUVD-2026-86845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97532 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

EUVD-2026-86840

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

CVE-2026-97532

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver within the qla2x00_mem_alloc() function's error path. When memory allocation fails, the function frees several adapter members (including elsrej.c , purex_dma_pool , and flt ) but leaves the pointers dangling. Consequently, the...

CVE-2026-97532

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

CVE-2026-97532 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

kernel: drm/amdgpu: Fix context pstate override handling

A flaw was found in the Linux kernel's amdgpu graphics driver. Improper handling of context pstate overrides can lead to use-after-free and NULL pointer dereferences during context initialization and finalization. A local attacker could exploit this vulnerability to cause system instability or a...

OESA-2026-4091 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4090 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4089 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4017 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2026-88389: NULL Pointer Dereference

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-98040

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

CVE-2026-88389

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

PT-2026-98861

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 Description A NULL pointer dereference occurs in the jslGetRawString function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the...

CVE-2026-88389

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-88389

Espruino 2v29 (commit bffc6d0 ) is susceptible to a NULL pointer dereference vulnerability within the jslGetRawString() function in src/jslex.c. Processing crafted raw or binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the abs...