CWE-476
CVEs classified under CWE-476, newest first.
347 CVEsRSS
CVE-2026-90792Medium· 4.3PoCA flaw has been found in GPAC up to f1219cde
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereferen…
CVE-2026-90609Low· 3.3PoCA vulnerability has been found in GPAC up to f1219cde
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be p…
CVE-2026-55209Critical· 9.8resdata is software for reading and writing result files from the Eclipse reservoir simulator
resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRD…
CVE-2026-53719Medium· 6.5Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a n…
CVE-2026-90782Medium· 5.3PoCS2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificati…
S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificati…
CVE-2026-90576Low· 3.3PoCA security vulnerability has been detected in GPAC up to f1219cde
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The…
CVE-2026-90573Low· 3.3PoCA vulnerability was identified in GPAC up to f1219cde
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is …
CVE-2026-15891High· 7.5The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted
The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded t…
CVE-2026-90485Medium· 5.5PoCA flaw has been found in IOBit Uninstaller 15.5.0.11
A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attac…
CVE-2026-80954Medium· 5.5⚖ disputedkernel: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() (CVE-2026-80954)
A flaw was found in the Linux kernel's i3c driver. The `i3c_device_get_supported_xfer_mode()` function attempts to access a device descriptor without holding the necessary lock. This unlocked dereference can lead to memory corruption, pote…
CVE-2026-89528High· 7.0kernel: svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528)
A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send specially crafted Read lists that exceed the page budget. This can lead to a NULL pointer dereference during Direct Memory Access (DMA) mapping, potenti…
CVE-2026-89581High· 7.0⚖ disputedkernel: bpf, x86: Fix per-CPU address resolution into an extended register (CVE-2026-89581)
A flaw was found in the Linux kernel's handling of Berkeley Packet Filter (BPF) programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker co…
CVE-2026-89570High· 7.0⚖ disputedkernel: cxl/mce: Make the MCE notifier per-region (CVE-2026-89570)
A flaw was found in the Linux kernel's Compute Express Link (CXL) subsystem. Lifetime issues with the CXL Machine Check Exception (MCE) notifier can lead to NULL dereferences and use-after-free vulnerabilities in the MCE handler. This coul…
CVE-2026-89561High· 7.5⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl…
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl…
CVE-2026-89544High· 7.5⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a …
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a …
CVE-2026-89686High· 7.0⚖ disputedkernel: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service (DoS). This occurs when the `nfsd4_alloc_layout…
CVE-2026-89679Medium· 5.5kernel: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs (CVE-2026-89679)
A flaw was found in the Linux kernel's nfsd component. A remote attacker can exploit this by sending a specially crafted SETATTR request that includes specific delegation timestamp attributes and a special NFSv4 state ID. This triggers a n…
CVE-2026-89709High· 7.0⚖ disputedkernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)
A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvc_ops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow …
CVE-2026-80963Medium· 5.5kernel: dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)
A flaw was found in the Linux kernel's `dm-stats` module. This vulnerability occurs when the allocation of per-CPU data fails, which can lead to a null pointer dereference during the subsequent cleanup operation. This issue can cause the s…
CVE-2026-81005Medium· 4.1kernel: ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. During the registration of an IPMI message handler, if the Baseboard Management Controller (BMC) device information cannot be fetched, a NUL…
CVE-2026-80992Medium· 5.5⚖ disputedkernel: net: ravb: avoid dereferencing an invalid PTP clock (CVE-2026-80992)
A flaw was found in the `net: ravb` component of the Linux kernel. This vulnerability allows for a NULL pointer dereference when the Precision Time Protocol (PTP) clock's index is queried before it is properly initialized or if its registr…
CVE-2026-80984Medium· 5.5kernel: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (CVE-2026-80984)
A flaw was found in the `net/smc` component of the Linux kernel. When a link group terminates while a socket is waiting in `smc_close_stream_wait()`, a NULL pointer dereference can occur during the SMC-D teardown path. This can lead to a s…
CVE-2026-89477High· 7.0kernel: sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. This vulnerability occurs when the kernel attempts to complete a stream reconfiguration request that has not been fully transmitted…
CVE-2026-89460Medium· 5.5kernel: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (CVE-2026-89460)
A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the `perf stat` command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly onli…
CVE-2026-89457Medium· 5.5kernel: s390/dasd: Guard sysfs discipline callbacks against unallocated private data (CVE-2026-89457)
A flaw was found in the s390/dasd component of the Linux kernel. An unprivileged local user can trigger a null pointer dereference by reading specific world-readable sysfs attributes while the device is being brought online. This can lead …
CVE-2026-89442Medium· 5.5⚖ disputedkernel: platform/x86: ISST: Validate socket ID in clos_assoc ioctl (CVE-2026-89442)
A flaw was found in the Linux kernel. The isst_if_clos_assoc ioctl function in the platform/x86: ISST module contains an improper validation of the socket_id. This allows a local attacker to cause an out-of-bounds access or a NULL pointer …
CVE-2026-89547High· 7.0kernel: SUNRPC: Check svc pool percpu counter allocation (CVE-2026-89547)
A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure le…
CVE-2026-89511Medium· 5.5⚖ disputedkernel: qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511)
A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA (TCP Segmentation Offload) continuation fragm…
CVE-2026-89662High· 7.0⚖ disputedkernel: NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can resu…
CVE-2026-89696Medium· 5.5⚖ disputedkernel: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd). A remote client can exploit this by sending a specially crafted NFS COMPOUND request. This request, when processed, can lead to a NULL pointer dereference in t…