CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6724 vulnerabilities reference this CWE, most recent first.
GHSA-G7MF-PJ82-5QHJ
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2022-03-19 00:01Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
{
"affected": [],
"aliases": [
"CVE-2022-0561"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.",
"id": "GHSA-g7mf-pj82-5qhj",
"modified": "2022-03-19T00:01:47Z",
"published": "2022-02-12T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0561"
},
{
"type": "WEB",
"url": "https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/362"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202210-10"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220318-0001"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5108"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G7PR-GF5R-FX64
Vulnerability from github – Published: 2024-03-03 00:30 – Updated: 2025-01-07 18:30In the Linux kernel, the following vulnerability has been resolved:
Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.
The commit above is reverted as it did not solve the original issue.
gsm_cleanup_mux() tries to free up the virtual ttys by calling gsm_dlci_release() for each available DLCI. There, dlci_put() is called to decrease the reference counter for the DLCI via tty_port_put() which finally calls gsm_dlci_free(). This already clears the pointer which is being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() as done in the reverted commit. The commit introduces a null pointer dereference: ? __die+0x1f/0x70 ? page_fault_oops+0x156/0x420 ? search_exception_tables+0x37/0x50 ? fixup_exception+0x21/0x310 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? tty_port_put+0x19/0xa0 gsmtty_cleanup+0x29/0x80 [n_gsm] release_one_tty+0x37/0xe0 process_one_work+0x1e6/0x3e0 worker_thread+0x4c/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30
The actual issue is that nothing guards dlci_put() from being called multiple times while the tty driver was triggered but did not yet finished calling gsm_dlci_free().
{
"affected": [],
"aliases": [
"CVE-2023-52564"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-02T22:15:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"tty: n_gsm: fix UAF in gsm_cleanup_mux\"\n\nThis reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239.\n\nThe commit above is reverted as it did not solve the original issue.\n\ngsm_cleanup_mux() tries to free up the virtual ttys by calling\ngsm_dlci_release() for each available DLCI. There, dlci_put() is called to\ndecrease the reference counter for the DLCI via tty_port_put() which\nfinally calls gsm_dlci_free(). This already clears the pointer which is\nbeing checked in gsm_cleanup_mux() before calling gsm_dlci_release().\nTherefore, it is not necessary to clear this pointer in gsm_cleanup_mux()\nas done in the reverted commit. The commit introduces a null pointer\ndereference:\n \u003cTASK\u003e\n ? __die+0x1f/0x70\n ? page_fault_oops+0x156/0x420\n ? search_exception_tables+0x37/0x50\n ? fixup_exception+0x21/0x310\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x26/0x30\n ? tty_port_put+0x19/0xa0\n gsmtty_cleanup+0x29/0x80 [n_gsm]\n release_one_tty+0x37/0xe0\n process_one_work+0x1e6/0x3e0\n worker_thread+0x4c/0x3d0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe1/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2f/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\n\nThe actual issue is that nothing guards dlci_put() from being called\nmultiple times while the tty driver was triggered but did not yet finished\ncalling gsm_dlci_free().",
"id": "GHSA-g7pr-gf5r-fx64",
"modified": "2025-01-07T18:30:38Z",
"published": "2024-03-03T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52564"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/29346e217b8ab8a52889b88f00b268278d6b7668"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2bff660e0ff349dee84dc4f6f6d10da4497f5b28"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d5c8862932d31a810b6545f7d69ecc124402c6e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a48d2bcd23f2c98d575bc2f9b7a3fbd16aeea9eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c61d0b87a7028c2c10faffc524d748334c7b9827"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/04/11/11"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/04/11/9"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/04/12/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/04/12/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G7QM-6VV8-CHVQ
Vulnerability from github – Published: 2025-09-18 15:30 – Updated: 2025-12-11 18:30In the Linux kernel, the following vulnerability has been resolved:
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file") introduced a null-deref if there are no vma's in the task in show_smaps_rollup.
{
"affected": [],
"aliases": [
"CVE-2022-50380"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-18T14:15:36Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: /proc/pid/smaps_rollup: fix no vma\u0027s null-deref\n\nCommit 258f669e7e88 (\"mm: /proc/pid/smaps_rollup: convert to single value\nseq_file\") introduced a null-deref if there are no vma\u0027s in the task in\nshow_smaps_rollup.",
"id": "GHSA-g7qm-6vv8-chvq",
"modified": "2025-12-11T18:30:33Z",
"published": "2025-09-18T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50380"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/33fc9e26b7cb39f0d4219c875a2451802249c225"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6bb8769326c46db3058780c0640dcc49d8187b24"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/97898139ca9b81ba9322a585e07490983c53b55a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a50ed2d28727ff605d95fb9a53be8ff94e8eaaf4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c4c84f06285e48f80e9843d0775ad92714ffc35a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dbe863bce7679c7f5ec0e993d834fe16c5e687b5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G7RF-8XCX-VFGM
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-01-14 18:31In the Linux kernel, the following vulnerability has been resolved:
clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference.
{
"affected": [],
"aliases": [
"CVE-2023-52865"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:23Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
"id": "GHSA-g7rf-8xcx-vfgm",
"modified": "2025-01-14T18:31:50Z",
"published": "2024-05-21T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52865"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/122ac6496e4975ddd7ec1edba4f6fc1e15e39478"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2705c5b97f504e831ae1935c05f0e44f80dfa6b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/357df1c2f6ace96defd557fad709ed1f9f70e16c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3aefc6fcfbada57fac27f470602d5565e5b76cb4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c79cbfb8e9e2311be77182893fda5ea4068c836"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/606f6366a35a3329545e38129804d65ef26ed7d2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81b16286110728674dcf81137be0687c5055e7bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/be3f12f16038a558f08fa93cc32fa715746a5235"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c26feedbc561f2a3cee1a4f717e61bdbdfb4fa92"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G849-5848-CC4R
Vulnerability from github – Published: 2026-09-22 21:31 – Updated: 2026-09-22 21:31InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2026-84396"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T19:16:54Z",
"severity": "MODERATE"
},
"details": "InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-g849-5848-cc4r",
"modified": "2026-09-22T21:31:26Z",
"published": "2026-09-22T21:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84396"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/indesign/apsb26-145.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G84Q-9979-4XF8
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-21 18:33In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2_find_fc_interface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.
{
"affected": [],
"aliases": [
"CVE-2026-43436"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T15:16:55Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces\n\nThe Scarlett2 mixer quirk in USB-audio driver may hit a NULL\ndereference when a malformed USB descriptor is passed, since it\nassumes the presence of an endpoint in the parsed interface in\nscarlett2_find_fc_interface(), as reported by fuzzer.\n\nFor avoiding the NULL dereference, just add the sanity check of\nbNumEndpoints and skip the invalid interface.",
"id": "GHSA-g84q-9979-4xf8",
"modified": "2026-05-21T18:33:06Z",
"published": "2026-05-08T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43436"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d4f23885e4b90347c9a1d779af6e79a99b5172a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d542cf3c4c854cdf5d58049771f68926b9eb2b9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b014cc945baba75816cda0cf8934be87c9ed4947"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b267255c15d2a5b90c4e926146aa155e5161e264"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/df1d8abf36ca3681c21a6809eaa9a1e01ef897a6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G852-MVXX-736R
Vulnerability from github – Published: 2025-04-08 09:31 – Updated: 2025-04-10 15:31In the Linux kernel, the following vulnerability has been resolved:
regulator: dummy: force synchronous probing
Sometimes I get a NULL pointer dereference at boot time in kobject_get() with the following call stack:
anatop_regulator_probe() devm_regulator_register() regulator_register() regulator_resolve_supply() kobject_get()
By placing some extra BUG_ON() statements I could verify that this is raised because probing of the 'dummy' regulator driver is not completed ('dummy_regulator_rdev' is still NULL).
In the JTAG debugger I can see that dummy_regulator_probe() and anatop_regulator_probe() can be run by different kernel threads (kworker/u4:*). I haven't further investigated whether this can be changed or if there are other possibilities to force synchronization between these two probe routines. On the other hand I don't expect much boot time penalty by probing the 'dummy' regulator synchronously.
{
"affected": [],
"aliases": [
"CVE-2025-22009"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T09:15:24Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: dummy: force synchronous probing\n\nSometimes I get a NULL pointer dereference at boot time in kobject_get()\nwith the following call stack:\n\nanatop_regulator_probe()\n devm_regulator_register()\n regulator_register()\n regulator_resolve_supply()\n kobject_get()\n\nBy placing some extra BUG_ON() statements I could verify that this is\nraised because probing of the \u0027dummy\u0027 regulator driver is not completed\n(\u0027dummy_regulator_rdev\u0027 is still NULL).\n\nIn the JTAG debugger I can see that dummy_regulator_probe() and\nanatop_regulator_probe() can be run by different kernel threads\n(kworker/u4:*). I haven\u0027t further investigated whether this can be\nchanged or if there are other possibilities to force synchronization\nbetween these two probe routines. On the other hand I don\u0027t expect much\nboot time penalty by probing the \u0027dummy\u0027 regulator synchronously.",
"id": "GHSA-g852-mvxx-736r",
"modified": "2025-04-10T15:31:48Z",
"published": "2025-04-08T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22009"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5ade367b56c3947c990598df92395ce737bee872"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8619909b38eeebd3e60910158d7d68441fc954e9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d3b83a1442a09b145006eb4294b1a963c5345c9c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e26f24ca4fb940b15e092796c5993142a2558bd9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G899-MR4G-V86J
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.
{
"affected": [],
"aliases": [
"CVE-2021-20274"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-09T14:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.",
"id": "GHSA-g899-mr4g-v86j",
"modified": "2022-05-24T17:43:53Z",
"published": "2022-05-24T17:43:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20274"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936662"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-16"
},
{
"type": "WEB",
"url": "https://www.privoxy.org/announce.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G8CQ-3XC6-HG2J
Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2022-01-15 00:03A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service.
{
"affected": [],
"aliases": [
"CVE-2021-46059"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-10T14:11:00Z",
"severity": "HIGH"
},
"details": "A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service.",
"id": "GHSA-g8cq-3xc6-hg2j",
"modified": "2022-01-15T00:03:28Z",
"published": "2022-01-11T00:01:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46059"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a9b015e2-59e3-4ed9-8812-d9021e40b8f2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HD5S2FC2HF22A7XQXK2XXIR46EARVWIM"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G8P3-WVVX-M6MF
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:32In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Don't setup bogus iov_iter for silencing
At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.
Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
{
"affected": [],
"aliases": [
"CVE-2026-64134"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:55Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Don\u0027t setup bogus iov_iter for silencing\n\nAt transition to the iov_iter for PCM data transfer, we blindly\napplied the iov_iter setup also for silencing (i.e. data = NULL), and\nit leads to a calculation of bogus iov_iter. Fortunately this didn\u0027t\ncause troubles on most of architectures but it goes wrong on RISC-V\nnow, causing a NULL dereference.\n\nHandle the NULL data case to treat the silencing in interleaved_copy()\nfor addressing the bug above. noninterleaved_copy() has already the\nNULL data handling, so it doesn\u0027t need changes.",
"id": "GHSA-g8p3-wvvx-m6mf",
"modified": "2026-07-20T15:32:01Z",
"published": "2026-07-19T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64134"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/41a766c647294842c9b17672449f8e011048cba9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c9f6768515818d71bdfc20119a81f3332c53b9c6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce836587e594af39ff048d9b29dee0f5f10692c9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e4d3386b74fba8e01280484b67ee481ece00201e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/feff0251386aa6bb180a0a1cf7c1f91ba868113d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.