CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6325 vulnerabilities reference this CWE, most recent first.
GHSA-3PVM-RCW8-28WJ
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).
{
"affected": [],
"aliases": [
"CVE-2020-19720"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T22:15:00Z",
"severity": "MODERATE"
},
"details": "An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).",
"id": "GHSA-3pvm-rcw8-28wj",
"modified": "2022-05-24T19:08:05Z",
"published": "2022-05-24T19:08:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19720"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/413"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3PX4-CC65-VWJJ
Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2026-05-12 15:31In the Linux kernel, the following vulnerability has been resolved:
media: venus: protect against spurious interrupts during probe
Make sure the interrupt handler is initialized before the interrupt is registered.
If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference.
This error condition has been observed during system boot on Rb3Gen2.
{
"affected": [],
"aliases": [
"CVE-2025-39709"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-05T18:15:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: protect against spurious interrupts during probe\n\nMake sure the interrupt handler is initialized before the interrupt is\nregistered.\n\nIf the IRQ is registered before hfi_create(), it\u0027s possible that an\ninterrupt fires before the handler setup is complete, leading to a NULL\ndereference.\n\nThis error condition has been observed during system boot on Rb3Gen2.",
"id": "GHSA-3px4-cc65-vwjj",
"modified": "2026-05-12T15:31:04Z",
"published": "2025-09-05T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39709"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18c2b2bd982b8546312c9a7895515672169f28e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3200144a2fa4209dc084a19941b9b203b43580f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/37cc0ac889b018097c217c5929fd6dc2aed636a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/639eb587f977c02423f4762467055b23902b4131"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88cf63c2599761c48dec8f618d57dccf8f6f4b53"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9db6a78bc5e418e0064e2248c8f3b9b9e8418646"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e796028b4835af00d9a38ebbb208ec3a6634702a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f54be97bc69b1096198b6717c150dec69f2a1b4d"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PX9-R72J-9HXJ
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-01-08 18:30In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg().
{
"affected": [],
"aliases": [
"CVE-2024-56535"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T14:15:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()\n\nkmalloc may fail, return value might be NULL and will cause\nNULL pointer dereference. Add check NULL return of kmalloc in\nbtc_fw_set_monreg().",
"id": "GHSA-3px9-r72j-9hxj",
"modified": "2025-01-08T18:30:47Z",
"published": "2024-12-27T15:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56535"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/051577414271961f3f4c3bff87b427924b486219"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64db1a42d98307001a48cec1b3e68ce9f905e73d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81df5ed446b448bdc327b7c7f0b50121fc1f4aa2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PXV-J5R5-V5QH
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-04 15:30In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt.
Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference.
Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users.
While fixing this bug we've gotten confused multiple times due to unclear terminology or missing concepts. So let's start this with some clarifications:
-
The terms "master" or "peer" denote a shared mount. A shared mount belongs to a peer group.
-
A peer group is a set of shared mounts that propagate to each other. They are identified by a peer group id. The peer group id is available in @shared_mnt->mnt_group_id. Shared mounts within the same peer group have the same peer group id. The peers in a peer group can be reached via @shared_mnt->mnt_share.
-
The terms "slave mount" or "dependent mount" denote a mount that receives propagation from a peer in a peer group. IOW, shared mounts may have slave mounts and slave mounts have shared mounts as their master. Slave mounts of a given peer in a peer group are listed on that peers slave list available at @shared_mnt->mnt_slave_list.
-
The term "master mount" denotes a mount in a peer group. IOW, it denotes a shared mount or a peer mount in a peer group. The term "master mount" - or "master" for short - is mostly used when talking in the context of slave mounts that receive propagation from a master mount. A master mount of a slave identifies the closest peer group a slave mount receives propagation from. The master mount of a slave can be identified via @slave_mount->mnt_master. Different slaves may point to different masters in the same peer group.
-
Multiple peers in a peer group can have non-empty ->mnt_slave_lists. Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to ensure all slave mounts of a peer group are visited the ->mnt_slave_lists of all peers in a peer group have to be walked.
-
Slave mounts point to a peer in the closest peer group they receive propagation from via @slave_mnt->mnt_master (see above). Together with these peers they form a propagation group (see below). The closest peer group can thus be identified through the peer group id @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave mount receives propagation from.
-
A shared-slave mount is a slave mount to a peer group pg1 while also a peer in another peer group pg2. IOW, a peer group may receive propagation from another peer group.
If a peer group pg1 is a slave to another peer group pg2 then all peers in peer group pg1 point to the same peer in peer group pg2 via ->mnt_master. IOW, all peers in peer group pg1 appear on the same ->mnt_slave_list. IOW, they cannot be slaves to different peer groups.
-
A pure slave mount is a slave mount that is a slave to a peer group but is not a peer in another peer group.
-
A propagation group denotes the set of mounts consisting of a single peer group pg1 and all slave mounts and shared-slave mounts that point to a peer in that peer group via ->mnt_master. IOW, all slave mounts such that @slave_mnt->mnt_master->mnt_group_id is equal to @shared_mnt->mnt_group_id.
The concept of a propagation group makes it easier to talk about a single propagation level in a propagation tree.
For example, in propagate_mnt() the immediate peers of @dest_mnt and all slaves of @dest_mnt's peer group form a propagation group pr ---truncated---
{
"affected": [],
"aliases": [
"CVE-2022-50280"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:39Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npnode: terminate at peers of source\n\nThe propagate_mnt() function handles mount propagation when creating\nmounts and propagates the source mount tree @source_mnt to all\napplicable nodes of the destination propagation mount tree headed by\n@dest_mnt.\n\nUnfortunately it contains a bug where it fails to terminate at peers of\n@source_mnt when looking up copies of the source mount that become\nmasters for copies of the source mount tree mounted on top of slaves in\nthe destination propagation tree causing a NULL dereference.\n\nOnce the mechanics of the bug are understood it\u0027s easy to trigger.\nBecause of unprivileged user namespaces it is available to unprivileged\nusers.\n\nWhile fixing this bug we\u0027ve gotten confused multiple times due to\nunclear terminology or missing concepts. So let\u0027s start this with some\nclarifications:\n\n* The terms \"master\" or \"peer\" denote a shared mount. A shared mount\n belongs to a peer group.\n\n* A peer group is a set of shared mounts that propagate to each other.\n They are identified by a peer group id. The peer group id is available\n in @shared_mnt-\u003emnt_group_id.\n Shared mounts within the same peer group have the same peer group id.\n The peers in a peer group can be reached via @shared_mnt-\u003emnt_share.\n\n* The terms \"slave mount\" or \"dependent mount\" denote a mount that\n receives propagation from a peer in a peer group. IOW, shared mounts\n may have slave mounts and slave mounts have shared mounts as their\n master. Slave mounts of a given peer in a peer group are listed on\n that peers slave list available at @shared_mnt-\u003emnt_slave_list.\n\n* The term \"master mount\" denotes a mount in a peer group. IOW, it\n denotes a shared mount or a peer mount in a peer group. The term\n \"master mount\" - or \"master\" for short - is mostly used when talking\n in the context of slave mounts that receive propagation from a master\n mount. A master mount of a slave identifies the closest peer group a\n slave mount receives propagation from. The master mount of a slave can\n be identified via @slave_mount-\u003emnt_master. Different slaves may point\n to different masters in the same peer group.\n\n* Multiple peers in a peer group can have non-empty -\u003emnt_slave_lists.\n Non-empty -\u003emnt_slave_lists of peers don\u0027t intersect. Consequently, to\n ensure all slave mounts of a peer group are visited the\n -\u003emnt_slave_lists of all peers in a peer group have to be walked.\n\n* Slave mounts point to a peer in the closest peer group they receive\n propagation from via @slave_mnt-\u003emnt_master (see above). Together with\n these peers they form a propagation group (see below). The closest\n peer group can thus be identified through the peer group id\n @slave_mnt-\u003emnt_master-\u003emnt_group_id of the peer/master that a slave\n mount receives propagation from.\n\n* A shared-slave mount is a slave mount to a peer group pg1 while also\n a peer in another peer group pg2. IOW, a peer group may receive\n propagation from another peer group.\n\n If a peer group pg1 is a slave to another peer group pg2 then all\n peers in peer group pg1 point to the same peer in peer group pg2 via\n -\u003emnt_master. IOW, all peers in peer group pg1 appear on the same\n -\u003emnt_slave_list. IOW, they cannot be slaves to different peer groups.\n\n* A pure slave mount is a slave mount that is a slave to a peer group\n but is not a peer in another peer group.\n\n* A propagation group denotes the set of mounts consisting of a single\n peer group pg1 and all slave mounts and shared-slave mounts that point\n to a peer in that peer group via -\u003emnt_master. IOW, all slave mounts\n such that @slave_mnt-\u003emnt_master-\u003emnt_group_id is equal to\n @shared_mnt-\u003emnt_group_id.\n\n The concept of a propagation group makes it easier to talk about a\n single propagation level in a propagation tree.\n\n For example, in propagate_mnt() the immediate peers of @dest_mnt and\n all slaves of @dest_mnt\u0027s peer group form a propagation group pr\n---truncated---",
"id": "GHSA-3pxv-j5r5-v5qh",
"modified": "2025-12-04T15:30:30Z",
"published": "2025-09-15T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50280"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/11933cf1d91d57da9e5c53822a540bbdc2656c16"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2dae4211b579ce98985876a73a78466e285238ff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/784a4f995ee24460aa72e00b085612fad57ebce5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f57df69de7f05302fad584eb8e3f34de39e0311"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b591b2919d018ef91b4a9571edca94105bcad3df"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c24cc476acd8bccb5af54849aac5e779d8223bf5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc997490be65da0af8c75a6244fc80bb66c53ce0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7c9f10c44a8919cd8bbd51b228c84d0caf7d518"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3Q2C-PVP5-3CQP
Vulnerability from github – Published: 2024-03-06 00:31 – Updated: 2024-11-05 18:31Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
{
"affected": [],
"aliases": [
"CVE-2024-24783"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T23:15:07Z",
"severity": "MODERATE"
},
"details": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.",
"id": "GHSA-3q2c-pvp5-3cqp",
"modified": "2024-11-05T18:31:58Z",
"published": "2024-03-06T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
},
{
"type": "WEB",
"url": "https://go.dev/cl/569339"
},
{
"type": "WEB",
"url": "https://go.dev/issue/65390"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-2598"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240329-0005"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3Q2J-JXJJ-F39G
Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2022-05-24 17:48NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.
{
"affected": [],
"aliases": [
"CVE-2021-1078"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-21T23:15:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may lead to system crash.",
"id": "GHSA-3q2j-jxjj-f39g",
"modified": "2022-05-24T17:48:16Z",
"published": "2022-05-24T17:48:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1078"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5172"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3Q6M-V84F-6P9H
Vulnerability from github – Published: 2023-10-30 15:08 – Updated: 2023-11-01 06:07quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.
Impact
An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.
Patches
v0.37.3 contains a patch. Versions before v0.37.0 are not affected.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/quic-go/quic-go"
},
"ranges": [
{
"events": [
{
"introduced": "0.37.0"
},
{
"fixed": "0.37.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46239"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-30T15:08:05Z",
"nvd_published_at": "2023-10-31T16:15:09Z",
"severity": "HIGH"
},
"details": "quic-go is an implementation of the [QUIC](https://datatracker.ietf.org/doc/html/rfc9000) transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.\n\n**Impact**\n\nAn attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.\n\n**Patches**\n\n[v0.37.3](https://github.com/quic-go/quic-go/releases/tag/v0.37.3) contains a patch. Versions before v0.37.0 are not affected.",
"id": "GHSA-3q6m-v84f-6p9h",
"modified": "2023-11-01T06:07:08Z",
"published": "2023-10-30T15:08:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46239"
},
{
"type": "WEB",
"url": "https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617"
},
{
"type": "PACKAGE",
"url": "https://github.com/quic-go/quic-go"
},
{
"type": "WEB",
"url": "https://github.com/quic-go/quic-go/releases/tag/v0.37.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "quic-go vulnerable to pointer dereference that can lead to panic"
}
GHSA-3Q6X-GXWH-88P9
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-08-29 03:30In the Linux kernel, the following vulnerability has been resolved:
lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
The kcalloc() in dmirror_device_evict_chunk() will return null if the physical memory has run out. As a result, if src_pfns or dst_pfns is dereferenced, the null pointer dereference bug will happen.
Moreover, the device is going away. If the kcalloc() fails, the pages mapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in kcalloc().
Finally, as there is no need to have physically contiguous memory, Switch kcalloc() to kvcalloc() in order to avoid failing allocations.
{
"affected": [],
"aliases": [
"CVE-2024-38543"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T14:15:14Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm.c: handle src_pfns and dst_pfns allocation failure\n\nThe kcalloc() in dmirror_device_evict_chunk() will return null if the\nphysical memory has run out. As a result, if src_pfns or dst_pfns is\ndereferenced, the null pointer dereference bug will happen.\n\nMoreover, the device is going away. If the kcalloc() fails, the pages\nmapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in\nkcalloc().\n\nFinally, as there is no need to have physically contiguous memory, Switch\nkcalloc() to kvcalloc() in order to avoid failing allocations.",
"id": "GHSA-3q6x-gxwh-88p9",
"modified": "2024-08-29T03:30:48Z",
"published": "2024-06-19T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38543"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a21fdeea502658e315bd939409b755974f4fb64"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/65e528a69cb3ed4a286c45b4afba57461c8b5b33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c2af060d1c18beaec56351cf9c9bcbbc5af341a3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce47e8ead9a72834cc68431d53f8092ce69bebb7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3Q8W-82VQ-P7RQ
Vulnerability from github – Published: 2024-07-30 09:32 – Updated: 2024-12-11 15:31In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Check socket flag instead of hcon
This fixes the following Smatch static checker warning:
net/bluetooth/iso.c:1364 iso_sock_recvmsg() error: we previously assumed 'pi->conn->hcon' could be null (line 1359)
net/bluetooth/iso.c 1347 static int iso_sock_recvmsg(struct socket sock, struct msghdr msg, 1348 size_t len, int flags) 1349 { 1350 struct sock sk = sock->sk; 1351 struct iso_pinfo pi = iso_pi(sk); 1352 1353 BT_DBG("sk %p", sk); 1354 1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 1356 lock_sock(sk); 1357 switch (sk->sk_state) { 1358 case BT_CONNECT2: 1359 if (pi->conn->hcon && ^^^^^^^^^^^^^^ If ->hcon is NULL
1360 test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) { 1361 iso_conn_big_sync(sk); 1362 sk->sk_state = BT_LISTEN; 1363 } else { --> 1364 iso_conn_defer_accept(pi->conn->hcon); ^^^^^^^^^^^^^^ then we're toast
1365 sk->sk_state = BT_CONFIG; 1366 } 1367 release_sock(sk); 1368 return 0; 1369 case BT_CONNECTED: 1370 if (test_bit(BT_SK_PA_SYNC,
{
"affected": [],
"aliases": [
"CVE-2024-42141"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T08:15:05Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Check socket flag instead of hcon\n\nThis fixes the following Smatch static checker warning:\n\nnet/bluetooth/iso.c:1364 iso_sock_recvmsg()\nerror: we previously assumed \u0027pi-\u003econn-\u003ehcon\u0027 could be null (line 1359)\n\nnet/bluetooth/iso.c\n1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,\n1348 size_t len, int flags)\n1349 {\n1350 struct sock *sk = sock-\u003esk;\n1351 struct iso_pinfo *pi = iso_pi(sk);\n1352\n1353 BT_DBG(\"sk %p\", sk);\n1354\n1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,\n \u0026bt_sk(sk)-\u003eflags)) {\n1356 lock_sock(sk);\n1357 switch (sk-\u003esk_state) {\n1358 case BT_CONNECT2:\n1359 if (pi-\u003econn-\u003ehcon \u0026\u0026\n ^^^^^^^^^^^^^^ If -\u003ehcon is NULL\n\n1360 test_bit(HCI_CONN_PA_SYNC,\n \u0026pi-\u003econn-\u003ehcon-\u003eflags)) {\n1361 iso_conn_big_sync(sk);\n1362 sk-\u003esk_state = BT_LISTEN;\n1363 } else {\n--\u003e 1364 iso_conn_defer_accept(pi-\u003econn-\u003ehcon);\n ^^^^^^^^^^^^^^\n then we\u0027re toast\n\n1365 sk-\u003esk_state = BT_CONFIG;\n1366 }\n1367 release_sock(sk);\n1368 return 0;\n1369 case BT_CONNECTED:\n1370 if (test_bit(BT_SK_PA_SYNC,",
"id": "GHSA-3q8w-82vq-p7rq",
"modified": "2024-12-11T15:31:15Z",
"published": "2024-07-30T09:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42141"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/045669710464a21c67e690ef14698fd71857cb11"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/33fabef489169c6db87843ef23351ed0d5e51ad8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/596b6f081336e77764ca35cfeab66d0fcdbe544e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3Q92-5VPF-96PW
Vulnerability from github – Published: 2025-08-27 18:31 – Updated: 2025-08-27 18:31A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.
{
"affected": [],
"aliases": [
"CVE-2025-20262"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-27T17:15:34Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, low-privileged, remote attacker to trigger a crash of the PIM6 process, resulting in a denial of service (DoS) condition.\n\nThis vulnerability is due to improper processing of PIM6 ephemeral data queries. An attacker could exploit this vulnerability by sending a crafted ephemeral query to an affected device through one of the following methods: NX-API REST, NETCONF, RESTConf, gRPC, or Model Driven Telemetry. A successful exploit could allow the attacker to cause the PIM6 process to crash and restart, causing potential adjacency flaps and resulting in a DoS of the PIM6 and ephemeral query processes.",
"id": "GHSA-3q92-5vpf-96pw",
"modified": "2025-08-27T18:31:54Z",
"published": "2025-08-27T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20262"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxospc-pim6-vG4jFPh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.