110153 matches found
EUVD-2026-80422
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...
CVE-2026-89822 drm/i915: Guard against NULL driver_data in i915_pci_probe()
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...
CVE-2026-89822
In the Linux kernel , the drm/i915 driver is vulnerable to a NULL pointer dereference in i915_pci_probe(). When a device is force-bound via the sysfs driver_override mechanism, pci_match_device() returns a dummy pci_device_id_any entry whose driver_data field is NULL. The probe function unconditi...
CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...
CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...
EUVD-2026-80409
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...
CVE-2026-89807
A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...
CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...
CVE-2026-89798
CVE-2026-89798 is a race condition in the Linux kernel's rpcrdma (RDMA) module. In rpcrdma_rn_register(), the notification object is inserted into the rd_xa xarray via xa_alloc() before the caller's callback is stored in rn->rn_done. Because notification objects are zero-allocated, a concurren...
CVE-2026-89798 rpcrdma: arm rn_done before publishing the notification
In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...
EUVD-2026-80398
In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...
CVE-2026-89798 rpcrdma: arm rn_done before publishing the notification
In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...
binutils: GNU Binutils: Local denial of service vulnerability
A flaw was found in GNU Binutils. A local attacker could exploit a null pointer dereference vulnerability in the ELF Section Handler. This could lead to a Denial of Service DoS, making the affected system or application unavailable...
binutils: GNU Binutils: Denial of Service via null pointer dereference
A flaw was found in GNU Binutils. A local attacker could exploit a null pointer dereference in the elfx86allocatedynrelocs function. This vulnerability could lead to a Denial of Service DoS condition, making the affected system or application unavailable...
binutils: GNU Binutils: Denial of Service via null pointer dereference
A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference within the Eh Frame Handler component by performing a specific manipulation. This vulnerability can lead to a Denial of Service DoS, making the affected system or application unavailable...
binutils: GNU Binutils: Local denial of service via null pointer dereference
A flaw was found in GNU Binutils. A local attacker can trigger a null pointer dereference by manipulating input to the 'elflinkaddobjectsymbols' function. This can lead to a denial of service DoS condition, making the affected component unavailable...
DEBIAN-CVE-2026-81642
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remot...
UBUNTU-CVE-2026-89780
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...
UBUNTU-CVE-2026-81642
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remot...
CVE-2026-89780 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...