CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

EUVD-2026-48869

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel wifi mt76 driver (mt7921/mt7925), CVE-2026-64325 describes a NULL pointer dereference triggered when a CSA beacon is processed and the station disconnects before the queued work runs. The issue arises from dereferencing dev->new_ctx without a NULL check in mt7921_channel_sw...

CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

EUVD-2026-49000

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

EUVD-2026-48970

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258

CVE-2026-64258 affects the Linux kernel fuse-uring path. When copying into the userspace ring buffer fails, fuse_uring_req_end() clears ent->fuse_req but may leave the ent_w_req_queue entry in FRRS_FUSE_REQ, enabling a NULL dereference during expiration scanning. The fix removes the entry from...

SUSE CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

SUSE CVE-2026-64220

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode-secondary to NULL in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing allocation functio...

SUSE CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...

SUSE CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

PT-2026-64552

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep dequeue vep alloc request wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vep dequeue without a valid UDC reference. Since vrequest-udc is never...

PT-2026-64710

In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd ctl new1 return value snd ctl new1 can return NULL when memory allocation fails. snd ymfpci create spdif controls does not check the return value before dereferencing kctl-id.device, which can lead to a NU...