CWE-476
CVEs classified under CWE-476, newest first.
994 CVEsRSS
CVE-2026-98747Medium· 4.4kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() (CVE-2026-98747)
A flaw was found in the Linux kernel's serial core subsystem. This flaw allows a local user with administrative access to cause a Denial of Service (DoS) by crashing the system. The issue occurs during the unregistration of a serial port t…
CVE-2026-98756Medium· 4.1kernel: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (CVE-2026-98756)
A flaw was found in the Linux kernel's Cadence USB3 driver. A local user could exploit this flaw to cause a Denial of Service (DoS) by crashing the system. During device discovery of a multi-function Cadence USBSS Peripheral Component Inte…
CVE-2026-98764Medium· 4.4kernel: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (CVE-2026-98764)
A flaw was found in the Linux kernel's USB (Universal Serial Bus) FunctionFS gadget subsystem. A local user can cause a Denial of Service (DoS) by triggering a kernel crash when querying endpoint descriptors on a USB gadget configured with…
CVE-2026-98785Medium· 4.7kernel: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (CVE-2026-98785)
A flaw was found in the Linux kernel's AMD display driver. During power management suspend operations under low memory conditions, the driver fails to handle memory allocation failures and retains an invalid null state. When the system sub…
CVE-2026-98786Medium· 4.7kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation (CVE-2026-98786)
A flaw was found in the Linux kernel's AMD GPU display driver. During DisplayPort Multi-Stream Transport (MST) display disconnection, a race condition can cause the driver to access display data structures without verifying that they remai…
CVE-2026-98791Medium· 4.4kernel: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference (CVE-2026-98791)
A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A local user can exploit this vulnerability to cause a denial of service (DoS) through a system crash. During the teardown of an AF_XDP (eXpress Data Path) transmit qu…
CVE-2026-98796Medium· 4.1kernel: net: ethernet: mtk_eth_soc: allocate dummy netdev sooner (CVE-2026-98796)
A flaw was found in the Linux kernel's MediaTek Ethernet driver. This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS) through a kernel crash. Due to an ordering issue during devic…
CVE-2026-98795Medium· 4.4kernel: net: sparx5: skip ptp deinit if init was skipped (CVE-2026-98795)
A flaw was found in the Linux kernel's Microchip Sparx5 network driver. When operating on devices where Precision Time Protocol (PTP) initialization is skipped, the driver does not check if PTP was initialized before executing its deinitia…
CVE-2026-98798Medium· 4.4kernel: net: bcmgenet: fix NULL dereference in set_coalesce before first open (CVE-2026-98798)
A flaw was found in the Linux kernel's Broadcom GENET network driver. A privileged local user could trigger a Denial of Service (DoS) by configuring receive coalescing settings on a network interface that has not yet been opened. This flaw…
CVE-2026-98803Medium· 6.5kernel: net: stmmac: fix rx Scatter-Gather support (CVE-2026-98803)
A flaw was found in the Linux kernel's stmmac ethernet driver. When receiving network frames larger than the primary buffer size, the Direct Memory Access (DMA) engine attempts to write excess data into a secondary receive buffer that is n…
CVE-2026-98806Medium· 4.4kernel: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (CVE-2026-98806)
A flaw was found in the Linux kernel's octeontx2-pf network driver. When Data Center Bridging (DCB) is enabled, the driver assumes traffic queue mapping structures are always initialized, which is not the case for System Data Path (SDP) vi…
CVE-2026-98812Medium· 5.5kernel: net/mctp: publish the mctp_dev only after it is initialised (CVE-2026-98812)
A flaw was found in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. During device setup, the kernel expose…
CVE-2026-98841Medium· 4.1kernel: virt: vmgenid: set driver_data before registering notification handlers (CVE-2026-98841)
A flaw was found in the Linux kernel's Virtual Machine Generation ID (vmgenid) driver. The driver registers interrupt and notification handlers before fully initializing driver data during startup. If an interrupt or notification is receiv…
CVE-2026-98849Medium· 4.7kernel: pfcp: fix socket lifetime on netdevice registration failure (CVE-2026-98849)
A flaw was found in the Linux kernel's Packet Forwarding Control Protocol (PFCP) driver. When creating a PFCP network interface, a failure during device registration triggers error handling that attempts to release an internal network sock…
CVE-2026-98854Medium· 4.1kernel: of/overlay: only treat a positive changeset id as registered (CVE-2026-98854)
A flaw was found in the Linux kernel's Device Tree overlay subsystem. When applying an overlay fails during identifier allocation, the error cleanup routine incorrectly treats negative error codes as valid identifiers. A local user could t…
CVE-2026-98476Medium· 4.7kernel: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (CVE-2026-98476)
A flaw was found in the Linux kernel's s390 channel I/O (CIO) subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could…
CVE-2026-98477Medium· 5.5perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a ta…
CVE-2026-98510Medium· 4.7⚖ disputedkernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVE-2026-98510)
A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thre…
CVE-2026-98565Medium· 4.4kernel: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (CVE-2026-98565)
A flaw was found in the Linux kernel's MediaTek MT7530 network switch driver. This flaw allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel crash. The issue occurs during driver unbinding …
CVE-2026-98564Medium· 4.1kernel: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (CVE-2026-98564)
A flaw was found in the Linux kernel's MediaTek MT7530 DSA (Distributed Switch Architecture) driver. During device removal or driver unbinding, interrupt mappings are prematurely disposed while the parent interrupt is still active. A local…
CVE-2026-98593Medium· 4.1kernel: s390/debug: Fix NULL pointer dereference in debug_info_copy() (CVE-2026-98593)
A flaw was found in the Linux kernel's s390 debug subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) through a kernel crash. When static debug registration encounters an error, internal memory pointers are…
CVE-2026-98616Medium· 4.1kernel: eth: fbnic: reset num_napi when the napi vectors are freed (CVE-2026-98616)
A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service (DoS). During power management suspend or failed resume operations, the driver frees interrupt v…
CVE-2026-111710High· 7.5Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers c…
CVE-2026-57486High· 7.5PoCpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespac…
CVE-2026-48741High· 7.5PoClibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validat…
CVE-2026-111373Medium· 5.3FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passe…
CVE-2026-111144Medium· 5.5PoClibansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file
libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custo…
CVE-2026-111129Medium· 5.5PoCOpen Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets
Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attac…
CVE-2026-111128Medium· 5.5PoCAssimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton…
CVE-2026-100353High· 7.5kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An una…