Linux Kernel Security Vulnerabilities

The Linux kernel version 4.16 contains a security vulnerability. This vulnerability stems from improper lifecycle management of the f2fs module’s f2fsgckthread component. Competition conditions occur during re-mounting or shutdown processes, potentially leading to access to an empty sbi-gcthread...

PT-2026-97877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client DFS cache where the get tgt name function returns an error pointer when the ce-tgthint variable is NULL. Additionally, the dfs cache noreq update tgthin...

CVE-2026-93210: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

PT-2026-104935

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: protect against NULL uart-port.dev in register serial8250 register 8250 port conditionally copies uart-port.dev from up-port.dev only when up-port.dev is non-NULL: if up-port.dev uart-port.dev = up-port.dev;...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.18.53 contain security vulnerabilities. This vulnerability stems from the serial8250register8250port function in drivers/tty/serial/8250/8250core.c, which does not perform a null pointer check when uart-port.dev is NULL. Subsequently, the hasacpicompanion...

CVE-2026-93261

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

PT-2026-98073

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel NULL pointer dereference occurs in the ntfs3 file system when processing a corrupted image. The issue is triggered when system.ntfs attrib is toggled and subsequently system.dos...

CVE-2026-93825: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

CVE-2026-97484: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. statusshowvhci checked for a NULL pdev but not for a NULL hcd...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

EUVD-2026-86314

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

CVE-2026-58006: Untrusted Pointer Dereference

Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...

ROS-20260924-73-0055

The vulnerability of the ntfsnew inode function in the fs/ntfs3/fsntfs.c file of the NTFS file system in the Linux operating system is related to the dereferencing of a NULL pointer. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

ROS-20260924-73-0077

The vulnerability of the replacenexthopsingle function in the net/ipv4/nexthop.c module of the Linux operating system’s IPv4 kernel implementation is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

ROS-20260924-73-0068

The vulnerability of the i40evalidatecloudfilter function in the drivers/net/ethernet/intel/i40e/i40evirtchnlpf.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacke...

ROS-20260924-73-0020

The vulnerability of the af9005i2cxfer function in the drivers/media/usb/dvb-usb/af9005.c file of the multimedia device driver for the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260924-73-0019

The vulnerability of the pnvpcisriovdisable function in the arch/powerpc/platforms/powernv/pci-sriov.c module of the PowerPC platform support for the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-105007

In the Linux kernel, the following vulnerability has been resolved: usbip: vhci hcd: fix NULL deref in status show vhci platform get drvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. status show vhci checked for a NULL pdev but not for a NULL...

CVE-2026-93207: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...