CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6629 vulnerabilities reference this CWE, most recent first.
GHSA-3HVR-PHFH-X26G
Vulnerability from github – Published: 2026-07-20 18:32 – Updated: 2026-08-23 15:32In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM.
Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states.
{
"affected": [],
"aliases": [
"CVE-2026-64192"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T17:18:22Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\n\nWhen CONFIG_BPF_LSM=y is set, BPF inode storage maps\n(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,\nif the BPF LSM is not explicitly enabled at boot time (e.g. omitted\nfrom the \"lsm=\" boot parameter), lsm_prepare() is never executed for\nthe BPF LSM.\n\nConsequently, the BPF inode security blob offset\n(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at\nits default compiled size of 8 bytes instead of being updated to a\nvalid offset past the reserved struct rcu_head (typically 16 bytes\nor more).\n\nWhen a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE\nmap, bpf_inode() evaluates inode-\u003ei_security + 8. This erroneously\naliases the struct rcu_head.func callback pointer at the beginning\nof the inode-\u003ei_security blob. During subsequent map element cleanup\nor inode destruction, writing NULL to owner_storage clears the queued\nRCU callback pointer. When rcu_do_batch() later executes the queued\ncallback, it attempts an instruction fetch at address 0x0, triggering\nan immediate kernel panic.\n\nFix this by introducing a global bpf_lsm_initialized boolean flag\nmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()\nwhen the LSM framework successfully registers the BPF LSM. Gate map\nallocation in inode_storage_map_alloc() on this flag, returning\n-EOPNOTSUPP if the BPF LSM is in turn uninitialized.\n\nThis fail-fast approach prevents userspace from allocating inode\nstorage maps when the supporting BPF LSM infrastructure is absent,\navoiding zombie map states.",
"id": "GHSA-3hvr-phfh-x26g",
"modified": "2026-08-23T15:32:54Z",
"published": "2026-07-20T18:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64192"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/267fdd9b6530c399dfd996e1a0a7628b45baf9f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/413b14b9623a2e6ee131c2b2152b304aeb04e378"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5337eebdf8c5d4810b1913047f078d2815d5645f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/721f669853bdbf46b475a81bb5d05d610f8c19de"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6d634f794c808a261eac7d5af023a7e06b9ecd8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c76b8abce575e0c6e4096957220b4515ed847d89"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de984ea883405420fdc416ae8964b752df586970"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HWM-6PXC-3VCF
Vulnerability from github – Published: 2022-09-08 00:00 – Updated: 2022-09-13 00:00xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulnerability allows attackers to cause a Denial of Service via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2022-36659"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulnerability allows attackers to cause a Denial of Service via unspecified vectors.",
"id": "GHSA-3hwm-6pxc-3vcf",
"modified": "2022-09-13T00:00:35Z",
"published": "2022-09-08T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36659"
},
{
"type": "WEB",
"url": "https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3J4F-WX4W-Q2CQ
Vulnerability from github – Published: 2024-02-22 18:30 – Updated: 2024-03-18 18:32In the Linux kernel, the following vulnerability has been resolved:
erofs: fix inconsistent per-file compression format
EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization.
However, syzkaller can generate inconsistent crafted images that use
an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA
algorithmtype even it's not set in sbi->available_compr_algs. This
can lead to an unexpected "BUG: kernel NULL pointer dereference" if
the corresponding decompressor isn't built-in.
Fix this by checking against sbi->available_compr_algs for each
m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset
bitmap is now fixed together since it was harmless previously.
{
"affected": [],
"aliases": [
"CVE-2024-26590"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-22T17:15:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inconsistent per-file compression format\n\nEROFS can select compression algorithms on a per-file basis, and each\nper-file compression algorithm needs to be marked in the on-disk\nsuperblock for initialization.\n\nHowever, syzkaller can generate inconsistent crafted images that use\nan unsupported algorithmtype for specific inodes, e.g. use MicroLZMA\nalgorithmtype even it\u0027s not set in `sbi-\u003eavailable_compr_algs`. This\ncan lead to an unexpected \"BUG: kernel NULL pointer dereference\" if\nthe corresponding decompressor isn\u0027t built-in.\n\nFix this by checking against `sbi-\u003eavailable_compr_algs` for each\nm_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset\nbitmap is now fixed together since it was harmless previously.",
"id": "GHSA-3j4f-wx4w-q2cq",
"modified": "2024-03-18T18:32:18Z",
"published": "2024-02-22T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26590"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3J85-RWQM-2894
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers.
{
"affected": [],
"aliases": [
"CVE-2022-27567"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers.",
"id": "GHSA-3j85-rwqm-2894",
"modified": "2022-04-19T00:01:16Z",
"published": "2022-04-12T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27567"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3J89-CV92-PV3W
Vulnerability from github – Published: 2022-01-22 00:00 – Updated: 2022-01-27 00:01A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).
{
"affected": [],
"aliases": [
"CVE-2021-46240"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-21T21:15:00Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c. This vulnerability can lead to a Denial of Service (DoS).",
"id": "GHSA-3j89-cv92-pv3w",
"modified": "2022-01-27T00:01:50Z",
"published": "2022-01-22T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46240"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/2028"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3JG5-5799-V5W6
Vulnerability from github – Published: 2024-02-23 15:30 – Updated: 2025-11-03 21:31In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1].
Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam().
[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 _syssendmsg+0x164/0x260 _sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
{
"affected": [],
"aliases": [
"CVE-2024-26595"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-23T15:15:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon \u0027region-\u003egroup-\u003etcam\u0027 [1].\n\nFix by retrieving the \u0027tcam\u0027 pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b",
"id": "GHSA-3jg5-5799-v5w6",
"modified": "2025-11-03T21:31:00Z",
"published": "2024-02-23T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26595"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3JHF-GXHR-Q4CX
Vulnerability from github – Published: 2025-07-31 18:31 – Updated: 2025-08-01 18:36Summary
When parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.
Details
In src/MaterialXCore/Material.cpp, in function getShaderNodes, the following code fetches the output nodes for a given nodegraph input node:
// SNIP...
else if (input->hasNodeGraphString())
{
// Check upstream nodegraph connected to the input.
// If no explicit output name given then scan all outputs on the nodegraph.
ElementPtr parent = materialNode->getParent();
NodeGraphPtr nodeGraph = parent->getChildOfType<NodeGraph>(input->getNodeGraphString());
if (!nodeGraph)
{
continue;
}
vector<OutputPtr> outputs;
if (input->hasOutputString())
{
outputs.push_back(nodeGraph->getOutput(input->getOutputString())); // <--- null ptr is returned
}
else
{
outputs = nodeGraph->getOutputs();
}
for (OutputPtr output : outputs)
{
NodePtr upstreamNode = output->getConnectedNode(); // <--- CRASHES HERE
if (upstreamNode && !shaderNodeSet.count(upstreamNode))
{
if (!target.empty() && !upstreamNode->getNodeDef(target))
{
continue;
}
shaderNodeVec.push_back(upstreamNode);
shaderNodeSet.insert(upstreamNode);
}
}
}
}
// SNIP...
The issues arise because the nodeGraph->getOutput(input->getOutputString()) call can return a null pointer, therefore when trying to call output->getConnectedNode(), this results in a crash .
PoC
Please download nullptr_getshadernodes.mltx from the following link:
https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010
build/bin/MaterialXView --material nullptr_getshadernodes.mtlx
Impact
An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "MaterialX"
},
"ranges": [
{
"events": [
{
"introduced": "1.39.2"
},
{
"fixed": "1.39.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.39.2"
]
}
],
"aliases": [
"CVE-2025-53010"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T18:31:11Z",
"nvd_published_at": "2025-08-01T18:15:54Z",
"severity": "LOW"
},
"details": "### Summary\n\nWhen parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files.\n\n### Details\n\nIn `src/MaterialXCore/Material.cpp`, in function `getShaderNodes`, the following code fetches the output nodes for a given `nodegraph` input node:\n\n```cpp\n// SNIP...\n else if (input-\u003ehasNodeGraphString())\n {\n // Check upstream nodegraph connected to the input.\n // If no explicit output name given then scan all outputs on the nodegraph.\n ElementPtr parent = materialNode-\u003egetParent();\n NodeGraphPtr nodeGraph = parent-\u003egetChildOfType\u003cNodeGraph\u003e(input-\u003egetNodeGraphString());\n if (!nodeGraph)\n {\n continue;\n }\n vector\u003cOutputPtr\u003e outputs;\n if (input-\u003ehasOutputString())\n {\n outputs.push_back(nodeGraph-\u003egetOutput(input-\u003egetOutputString())); // \u003c--- null ptr is returned\n }\n else\n {\n outputs = nodeGraph-\u003egetOutputs();\n }\n for (OutputPtr output : outputs)\n {\n NodePtr upstreamNode = output-\u003egetConnectedNode(); // \u003c--- CRASHES HERE\n if (upstreamNode \u0026\u0026 !shaderNodeSet.count(upstreamNode))\n {\n if (!target.empty() \u0026\u0026 !upstreamNode-\u003egetNodeDef(target))\n {\n continue;\n }\n shaderNodeVec.push_back(upstreamNode);\n shaderNodeSet.insert(upstreamNode);\n }\n }\n }\n }\n// SNIP...\n```\n\nThe issues arise because the `nodeGraph-\u003egetOutput(input-\u003egetOutputString())` call can return a null pointer, therefore when trying to call `output-\u003egetConnectedNode()`, this results in a crash .\n\n\n### PoC\n\nPlease download `nullptr_getshadernodes.mltx` from the following link:\n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-53010\n\n`build/bin/MaterialXView --material nullptr_getshadernodes.mtlx`\n\n\n### Impact\n\nAn attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file.",
"id": "GHSA-3jhf-gxhr-q4cx",
"modified": "2025-08-01T18:36:02Z",
"published": "2025-07-31T18:31:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-3jhf-gxhr-q4cx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53010"
},
{
"type": "WEB",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX/commit/e13344ba13326869d7820b444705f24d56fab73d"
},
{
"type": "PACKAGE",
"url": "https://github.com/AcademySoftwareFoundation/MaterialX"
},
{
"type": "WEB",
"url": "https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph-\u003egetOutput return"
}
GHSA-3JMW-8HR3-2J76
Vulnerability from github – Published: 2026-08-06 00:31 – Updated: 2026-08-07 00:31In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
{
"affected": [],
"aliases": [
"CVE-2026-67870"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T00:16:54Z",
"severity": "CRITICAL"
},
"details": "In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.",
"id": "GHSA-3jmw-8hr3-2j76",
"modified": "2026-08-07T00:31:08Z",
"published": "2026-08-06T00:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67870"
},
{
"type": "WEB",
"url": "https://github.com/open62541/open62541/issues/8172"
},
{
"type": "WEB",
"url": "https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/types.h"
},
{
"type": "WEB",
"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_nodemanagement.c"
},
{
"type": "WEB",
"url": "https://github.com/open62541/open62541/blob/v1.5.5/src/ua_types.c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3JP7-X2F9-J2C3
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-05-20 00:31In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
When a process crashes and the kernel writes a core dump to a 9P filesystem, __kernel_write() creates an ITER_KVEC iterator. This iterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which only handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types, hitting the BUG() for any other type.
Fix this by adding netfs_limit_kvec() following the same pattern as netfs_limit_bvec(), since both kvec and bvec are simple segment arrays with pointer and length fields. Dispatch it from netfs_limit_iter() when the iterator type is ITER_KVEC.
{
"affected": [],
"aliases": [
"CVE-2026-31438"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:37Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators\n\nWhen a process crashes and the kernel writes a core dump to a 9P\nfilesystem, __kernel_write() creates an ITER_KVEC iterator. This\niterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which\nonly handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,\nhitting the BUG() for any other type.\n\nFix this by adding netfs_limit_kvec() following the same pattern as\nnetfs_limit_bvec(), since both kvec and bvec are simple segment arrays\nwith pointer and length fields. Dispatch it from netfs_limit_iter() when\nthe iterator type is ITER_KVEC.",
"id": "GHSA-3jp7-x2f9-j2c3",
"modified": "2026-05-20T00:31:40Z",
"published": "2026-04-22T15:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31438"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/00d6df7115f6972370974212de9088087820802e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18c2e20b42dd21db599e42d05ddaeeb647b2bb6d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4bc2d72c7695cedf6d4e1a558924903c2b28a78e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/67e467a11f62ff64ad219dc6aa5459e132c79d14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3JW4-RRQ4-7G22
Vulnerability from github – Published: 2024-04-03 18:30 – Updated: 2025-02-27 15:31In the Linux kernel, the following vulnerability has been resolved:
spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error:
Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000008 Call trace: complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc
{
"affected": [],
"aliases": [
"CVE-2024-26776"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T17:15:53Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\n\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\n\n Unable to handle kernel NULL pointer dereference at virtual\n address 0000000000000008\n Call trace:\n complete+0x54/0x100\n hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n __handle_irq_event_percpu+0x64/0x1e0\n handle_irq_event+0x7c/0x1cc",
"id": "GHSA-3jw4-rrq4-7g22",
"modified": "2025-02-27T15:31:49Z",
"published": "2024-04-03T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26776"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0399d7eba41d9b28f5bdd7757ec21a5b7046858d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d637b5118274701e8448f35953877daf04df18b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de8b6e1c231a95abf95ad097b993d34b31458ec9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e4168ac25b4bd378bd7dda322d589482a136c1fd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e94da8aca2e78ef9ecca02eb211869eacd5504e5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f19361d570c67e7e014896fa2dacd7d721bf0aa8"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.