PT-2026-94598

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference occurs in the bpf and cgroup components when replacing a program. This happens when an empty program attached to a cgroup is replaced by a new program that...

PT-2026-94433

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the rvu dbg nix tm tree display function. This occurs when the function accesses pfvf-sq ctx without verifying if the SQ context has been allocated...

PT-2026-94428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the octeontx2-pf driver when setting up representors. The af xdp zc qidx pointer, which tracks receive queues using AF XDP zero-copy, remains NULL fo...

PT-2026-94520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smbdirect component of the Linux kernel where memory pools are destroyed before the Queue Pair QP during an accept failure. In the rdma accept failed error path of...

PT-2026-94492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the dpll device ops function during a teardown race condition. This happens when the last owner of a dpll device unregisters while another driver sti...

CVE-2026-76781: NULL Pointer Dereference

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

PT-2026-94910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the san probe function when installing the GSBUS address space handler. This happens because the function dereferences the result of ACPI COMPANION...

CVE-2026-90297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

PT-2026-94722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 driver within the mt76 wifi module. The band idx value, derived from a 2-bit descriptor field ranging from 0 to 3, is used directly to index the dev-mt76.ph...

CVE-2026-93056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

CVE-2026-90228: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

CVE-2026-93118: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

PT-2026-94550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mpt3sas SCSI driver where the base release memory pools function unconditionally frees every entry in the ioc-pcie sg lookup array. This includes entries that were...

CVE-2026-90102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

PT-2026-94935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/mes component where a loop limit for hung queue db array was incorrectly set to only AMDGPU MAX MES PIPES iterations. On multi-XCC X-Complexity Cluster...

CVE-2026-90207: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-90281: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

CVE-2026-93073: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

PT-2026-94439

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth L2CAP implementation. For L2CAP sockets that do not own sk-sk socket, a lockless read of l2cap pisk-chan within the l2cap sock cleanup listen...

PT-2026-94777

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/tegra241-cmdqv component where the error interrupt service routine ISR is not properly synchronized with VINTF initialization and deinitialization. The...