CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6750 vulnerabilities reference this CWE, most recent first.
GHSA-M68Q-HXMP-JH9G
Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-20 18:31In the Linux kernel, the following vulnerability has been resolved:
iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient.
{
"affected": [],
"aliases": [
"CVE-2023-53476"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T12:15:49Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()\n\nThis condition needs to match the previous \"if (epcp-\u003estate == LISTEN) {\"\nexactly to avoid a NULL dereference of either \"listen_ep\" or \"ep\". The\nproblem is that \"epcp\" has been re-assigned so just testing\n\"if (epcp-\u003estate == LISTEN) {\" a second time is not sufficient.",
"id": "GHSA-m68q-hxmp-jh9g",
"modified": "2026-01-20T18:31:52Z",
"published": "2025-10-01T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53476"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24278dc380aab6a1aef0a75317f57ad4c2453cf6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4ca446b127c568b59cb8d9748b6f70499624bb18"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76e0396313c79ecd0df44ee3c18745cfac52b3e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dd55240e4364d64befcc575b0d33091881524f42"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6C4-7R62-X4HM
Vulnerability from github – Published: 2024-08-14 15:31 – Updated: 2024-08-14 15:31Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2024-34137"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T15:15:20Z",
"severity": "MODERATE"
},
"details": "Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-m6c4-7r62-x4hm",
"modified": "2024-08-14T15:31:17Z",
"published": "2024-08-14T15:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34137"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/illustrator/apsb24-45.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6CW-M47W-WQ2G
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
{
"affected": [],
"aliases": [
"CVE-2021-31260"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-19T19:15:00Z",
"severity": "MODERATE"
},
"details": "The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.",
"id": "GHSA-m6cw-m47w-wq2g",
"modified": "2022-05-24T17:47:52Z",
"published": "2022-05-24T17:47:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31260"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/1736"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/df8fffd839fe5ae9acd82d26fd48280a397411d9"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M6F7-Q6M8-788V
Vulnerability from github – Published: 2022-05-14 02:03 – Updated: 2022-05-14 02:03The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.
{
"affected": [],
"aliases": [
"CVE-2018-1095"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-02T03:29:00Z",
"severity": "HIGH"
},
"details": "The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.",
"id": "GHSA-m6f7-q6m8-788v",
"modified": "2022-05-14T02:03:05Z",
"published": "2022-05-14T02:03:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1095"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2948"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-1095"
},
{
"type": "WEB",
"url": "https://bugzilla.kernel.org/show_bug.cgi?id=199185"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1560793"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=ce3fd194fcc6fbdc00ce095a852f22df97baa401"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3695-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3695-2"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/03/29/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6M4-PPMJ-PPV3
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
{
"affected": [],
"aliases": [
"CVE-2014-2678"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-01T06:35:00Z",
"severity": "MODERATE"
},
"details": "The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.",
"id": "GHSA-m6m4-ppmj-ppv3",
"modified": "2022-05-13T01:17:56Z",
"published": "2022-05-13T01:17:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2678"
},
{
"type": "WEB",
"url": "https://lkml.org/lkml/2014/3/29/188"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0926-1.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0926.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131276.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59386"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60130"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60471"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/03/31/10"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/66543"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M6MF-CRM7-82WQ
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-09-04 15:35In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-dj: Fix maxfield check in DJ short report validation
Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for the DJ short output report, but the error path dereferences rep->field[0] even when rep->maxfield is zero.
Commit 8b9a097eb2fc ("HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report") made the check conditional on rep being present, but a crafted descriptor can still create report ID 0x20 with only padding output items. hid-core registers the report, ignores the padding field, and leaves rep->maxfield as zero.
In that case the validation enters the rep->maxfield < 1 branch and then dereferences rep->field[0]->report_count while printing the error message, causing a NULL pointer dereference during probe. This is reproducible with uhid by emulating a Logitech receiver with a padding-only DJ short output report:
BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj] Read of size 4 at addr 0000000000000028 by task kworker/4:1/129 ... Call Trace: logi_dj_probe+0xb1/0x754 [hid_logitech_dj] hid_device_probe+0x329/0x3f0 [hid] really_probe+0x162/0x570 __device_attach+0x137/0x2c0 bus_probe_device+0x38/0xc0 device_add+0xa56/0xce0 hid_add_device+0x19c/0x280 [hid] uhid_device_add_worker+0x2c/0xb0 [uhid]
Reject the zero-field report before printing the field report_count.
{
"affected": [],
"aliases": [
"CVE-2026-64427"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:26Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-dj: Fix maxfield check in DJ short report validation\n\nCommit b6a57912854e (\"HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT\nrelated user initiated OOB write\") added validation for the DJ short\noutput report, but the error path dereferences rep-\u003efield[0] even when\nrep-\u003emaxfield is zero.\n\nCommit 8b9a097eb2fc (\"HID: logitech-dj: fix wrong detection of bad\nDJ_SHORT output report\") made the check conditional on rep being present,\nbut a crafted descriptor can still create report ID 0x20 with only padding\noutput items. hid-core registers the report, ignores the padding field,\nand leaves rep-\u003emaxfield as zero.\n\nIn that case the validation enters the rep-\u003emaxfield \u003c 1 branch and then\ndereferences rep-\u003efield[0]-\u003ereport_count while printing the error message,\ncausing a NULL pointer dereference during probe. This is reproducible with\nuhid by emulating a Logitech receiver with a padding-only DJ short output\nreport:\n\n BUG: KASAN: null-ptr-deref in logi_dj_probe+0xb1/0x754 [hid_logitech_dj]\n Read of size 4 at addr 0000000000000028 by task kworker/4:1/129\n ...\n Call Trace:\n logi_dj_probe+0xb1/0x754 [hid_logitech_dj]\n hid_device_probe+0x329/0x3f0 [hid]\n really_probe+0x162/0x570\n __device_attach+0x137/0x2c0\n bus_probe_device+0x38/0xc0\n device_add+0xa56/0xce0\n hid_add_device+0x19c/0x280 [hid]\n uhid_device_add_worker+0x2c/0xb0 [uhid]\n\nReject the zero-field report before printing the field report_count.",
"id": "GHSA-m6mf-crm7-82wq",
"modified": "2026-09-04T15:35:55Z",
"published": "2026-07-25T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64427"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1215febd644c3e16f77e0f1799d89544dd57a754"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2b70bebc709489d29a31ac2935aeffb8d5228395"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/590cc4d782487632a52f37c2171bee1eeea29627"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6f7f22a8d244c2e586b8eb61c7585784b62aea01"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a89ad762fad53d56b7002d7ffc923a4b7f4006f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/80c1e18473f63fd7c6a2bc9ad6f3d0a6cc4fb500"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95b3f23d632490b5eb285b9fcf7284f2ac8f9872"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f3790a6af9c7f47d454225cab9dc145270e48f62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6Q7-6HRV-F732
Vulnerability from github – Published: 2025-03-17 21:30 – Updated: 2025-03-17 21:30In the Linux kernel, the following vulnerability has been resolved:
net: sparx5: switchdev: fix possible NULL pointer dereference
As the possible failure of the allocation, devm_kzalloc() may return NULL pointer. Therefore, it should be better to check the 'db' in order to prevent the dereference of NULL pointer.
{
"affected": [],
"aliases": [
"CVE-2022-49184"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:00:55Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: switchdev: fix possible NULL pointer dereference\n\nAs the possible failure of the allocation, devm_kzalloc() may return NULL\npointer.\nTherefore, it should be better to check the \u0027db\u0027 in order to prevent\nthe dereference of NULL pointer.",
"id": "GHSA-m6q7-6hrv-f732",
"modified": "2025-03-17T21:30:31Z",
"published": "2025-03-17T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49184"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0906f3a3df07835e37077d8971aac65347f2ed57"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b375ea083fa649092cd016ac1f89a2d1fd8f8e8b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c346791877e6ce923bb21e34b30c6f99326aa5a8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7e1fff76c4c57688dc7d53a3b6212182d5628d0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6QQ-C4RP-76FQ
Vulnerability from github – Published: 2022-05-17 00:12 – Updated: 2022-05-17 00:12K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002570 DeviceIoControl request.
{
"affected": [],
"aliases": [
"CVE-2017-17464"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-08T05:29:00Z",
"severity": "CRITICAL"
},
"details": "K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x95002570 DeviceIoControl request.",
"id": "GHSA-m6qq-c4rp-76fq",
"modified": "2022-05-17T00:12:30Z",
"published": "2022-05-17T00:12:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17464"
},
{
"type": "WEB",
"url": "https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/K7-Antivirus/K7Anti_Nullptr_Dereference_0x95002570"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6R3-9WWQ-X2MJ
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-04-04 07:06A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
{
"affected": [],
"aliases": [
"CVE-2022-28070"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:22Z",
"severity": "HIGH"
},
"details": "A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.",
"id": "GHSA-m6r3-9wwq-x2mj",
"modified": "2024-04-04T07:06:59Z",
"published": "2023-08-22T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28070"
},
{
"type": "WEB",
"url": "https://github.com/radareorg/radare2/commit/4aff1bb00224de4f5bc118f987dfd5d2fe3450d0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6RJ-HX92-C739
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sys_ring_buf_get() and sys_ring_buf_put).
{
"affected": [],
"aliases": [
"CVE-2018-1000800"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-06T17:29:00Z",
"severity": "CRITICAL"
},
"details": "zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sys_ring_buf_get() and sys_ring_buf_put).",
"id": "GHSA-m6rj-hx92-c739",
"modified": "2022-05-13T01:26:35Z",
"published": "2022-05-13T01:26:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000800"
},
{
"type": "WEB",
"url": "https://github.com/zephyrproject-rtos/zephyr/issues/7638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.