PT-2026-94533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where configfs attribute stores are not properly serialized with a lock. This occurs because the NULLB DEVICE ATTR store does not utilize a lock,...

CVE-2026-90250: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-76781: NULL Pointer Dereference

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

PT-2026-94366

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description A flaw in the XML catalog parsing process allows a local user or an attacker to trigger a NULL pointer dereference by providing a specially crafted XML catalog. This occurs when a nextCatalog...

CVE-2026-90335: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

PT-2026-94683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference occurs during TTY device removal. This happens when TTY device registration fails before a cdev is allocated, but the serial core retains the port for use by...

PT-2026-94976

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the panthor driver during the split of GPU mapping caused by a partial unmap of an evicted Buffer Object BO. The issue arises because the logic...

PT-2026-94577

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-apple driver where the admin queue, allocated via blk mq alloc queue, is not properly destroyed during removal. When the controller fails to initialize and is...

PT-2026-94920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the asus-wireless platform driver where the asus wireless probe function returns success even when acpi match acpi device finds no match. This occurs because platform...

CVE-2026-93068: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-92914: Improper Authentication

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-90144: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

PT-2026-94629

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur during early runtime suspend in the snps-femto-v2 PHY driver. This happens because runtime Power Management PM callbacks may dereference the hsphy...

PT-2026-94534

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the null blk driver where resizing submit queues or poll queues via configfs on a device with shared tags enabled can lead to a kernel crash. When a shared tag set is...

CVE-2026-90166: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90405: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: fix some error handling bugs in probe There are a few issues here: 1 After we assign: chan = dmarequestchan&pdev-dev, "tx"; Then the error paths need to clean up before returning. The first error path does a...

CVE-2026-90426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

CVE-2026-90397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...