EUVD-2026-86848

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

CVE-2026-97540 net: usb: pegasus: don't rely on id table pointer arithmetic

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

CVE-2026-97540

The Linux kernel contains a vulnerability in the usb pegasus driver where the code incorrectly relies on id table pointer arithmetic when handling dynamic IDs. Because the usb_device_id parameter resides on the heap in these cases, the pointer arithmetic results in an out-of-bounds index . The is...

CVE-2026-97540 net: usb: pegasus: don't rely on id table pointer arithmetic

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

CVE-2026-97539

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is...

CVE-2026-97537 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

EUVD-2026-86845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97537

The Linux kernel contains a vulnerability in the scsi qla2xxx driver within the qla25xx_free_req_que() and qla25xx_free_rsp_que() functions. Two specific issues occur on the error path of queue creation: first, an unconditional dma_free_coherent() call with a NULL pointer (resulting from a dma_al...

CVE-2026-97532

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver within the qla2x00_mem_alloc() function's error path. When memory allocation fails, the function frees several adapter members (including elsrej.c , purex_dma_pool , and flt ) but leaves the pointers dangling. Consequently, the...

CVE-2026-97532 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

EUVD-2026-86840

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

CVE-2026-97532 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

kernel: drm/amdgpu: Fix context pstate override handling

A flaw was found in the Linux kernel's amdgpu graphics driver. Improper handling of context pstate overrides can lead to use-after-free and NULL pointer dereferences during context initialization and finalization. A local attacker could exploit this vulnerability to cause system instability or a...

OESA-2026-4091 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4089 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4090 poco security update

This is ROS melodic roscomm's 3rdparty poco. Security Fixes: A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. T...

OESA-2026-4017 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

PT-2026-98861

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 Description A NULL pointer dereference occurs in the jslGetRawString function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the...

EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-88389

Espruino 2v29 (commit bffc6d0 ) is susceptible to a NULL pointer dereference vulnerability within the jslGetRawString() function in src/jslex.c. Processing crafted raw or binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the abs...