CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

CVE-2026-18417

The Zephyr RTOS native BSD-socket layer contains a wild pointer dereference vulnerability when a TCP listening socket reports an asynchronous error. The root cause is type-punning an error status into the user_data field of struct net_context. In version v4.3.0 , a second interface-down event can...

CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

SUSE CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

DEBIAN-CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

AZL-101682 CVE-2026-89849 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89849

This vulnerability affects the qla2xxx SCSI driver in the Linux kernel . The root cause is a logic flaw in qla2x00_status_entry(): after filtering out certain SRB types, the code falls through to a SCSI fast path that unconditionally assumes the command is an SRB_SCSI_CMD. Because the srb union o...

CVE-2026-89849 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89849: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

PT-2026-93490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx driver where the qla2x00 status entry function fails to properly validate SCSI Request Blocks SRB before they enter the SCSI fast path. The function filter...

Linux Distros Unpatched Vulnerability : CVE-2026-89849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non- TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD type...

CVE-2026-10773: Out-of-bounds Read

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...

CVE-2025-62609 MLX has Wild Pointer Dereference in load_gguf()

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::loadgguf when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This iss...

EUVD-2025-5975

Malicious code in bioql PyPI...

CVE-2025-21810

Technical details for CVE-2025-21810 are not publicly available in the provided connected documents. Monitor kernel advisories and vendor advisories for affected versions, impact, and fixes.

PT-2025-9001

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential wild pointer dereferences issue exists in the Linux kernel regarding the APIs class dev iter init, class dev iter next, and class dev iter exit. The issue arises when the cla...

CVE-2024-0744

In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox 122...