CVE-2026-99126None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
0.2% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
s390/ctcm: Prevent XID null dereference
The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference.
Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.
Linux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < f9d9e2dadc9fbdfe01aeb6581978c3b59092919eLinux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < a7c3e1795e4fe5e6680cab7cd7eee0503b00a248Linux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < c11e435d334e4c311eaaf721e179a5ca6852c221Linux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < 977dac6cc5531a8e058df05b6af94406b940cb9eLinux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < 1525fb6e2f9f9a2c8c8723ee0959b1130a6b8213Linux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < 34fa3607b7604b3052b19cec8b0ad644818cdd2aLinux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < 8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeabLinux >= 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 < b264d8422779d69febce914efc47a92a85cc382cLinux 2.6.26Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses