Common Weakness Enumeration
CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6314 vulnerabilities reference this CWE, most recent first.
GHSA-RQ5J-M653-58GG
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-04 15:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference.
Patchwork: https://patchwork.freedesktop.org/patch/517646/
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-53223"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:49Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dsi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue as it may return\nNULL pointer and cause NULL pointer dereference.\n\nPatchwork: https://patchwork.freedesktop.org/patch/517646/",
"id": "GHSA-rq5j-m653-58gg",
"modified": "2025-12-04T15:30:32Z",
"published": "2025-09-15T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53223"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/115906ca7b535afb1fe7b5406c566ccd3873f82b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/25a6499b1a53d854eda2b161b5c8a20296515dbe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a9a4a9725c60f04326b5019a52ce15aee808506"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3e18f157faeeb59034404569e8e07cbe1c0030a7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/540c66180afd59309a442d3bf1f2393464c8b4c5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5dfe7a5386fde5a656ca06602b31bf50e26954cd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/759ea5677c362fb1e3edc667260ba9f409dc931d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9257974858ee847b2e1fd552691b8ba5c2fc1c7b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQ64-8M54-26J4
Vulnerability from github – Published: 2022-05-14 01:07 – Updated: 2025-04-20 03:37
VLAI
Details
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-3730"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-04T19:29:00Z",
"severity": "HIGH"
},
"details": "In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.",
"id": "GHSA-rq64-8m54-26j4",
"modified": "2025-04-20T03:37:13Z",
"published": "2022-05-14T01:07:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3730"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201702-07"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03838en_us"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41192"
},
{
"type": "WEB",
"url": "https://www.openssl.org/news/secadv/20170126.txt"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95812"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037717"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQ69-PG5Q-R2X8
Vulnerability from github – Published: 2022-04-21 01:57 – Updated: 2024-02-28 01:13
VLAI
Details
Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful, causing a remote denial of service condition.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2010-3048"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-16T18:15:00Z",
"severity": "HIGH"
},
"details": "Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful, causing a remote denial of service condition.",
"id": "GHSA-rq69-pg5q-r2x8",
"modified": "2024-02-28T01:13:35Z",
"published": "2022-04-21T01:57:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3048"
},
{
"type": "WEB",
"url": "http://www.fuzzmyapp.com/advisories/FMA-2010-002/FMA-2010-002-EN.xml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQ9H-37GR-2M9P
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2025-04-12 12:34
VLAI
Details
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
{
"affected": [],
"aliases": [
"CVE-2014-3470"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-06-05T21:55:00Z",
"severity": "MODERATE"
},
"details": "The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.",
"id": "GHSA-rq9h-37gr-2m9p",
"modified": "2025-04-12T12:34:35Z",
"published": "2022-05-14T01:08:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3470"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103600"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf"
},
{
"type": "WEB",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=8011cd56e39a433b1837465259a9bd24a38727fb"
},
{
"type": "WEB",
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=8011cd56e39a433b1837465259a9bd24a38727fb"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946"
},
{
"type": "WEB",
"url": "https://kb.bluecoat.com/index?page=content\u0026id=SA80"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10075"
},
{
"type": "WEB",
"url": "https://www.novell.com/support/kb/doc.php?id=7015271"
},
{
"type": "WEB",
"url": "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc"
},
{
"type": "WEB",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10629"
},
{
"type": "WEB",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=KB29195"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140266410314613\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140317760000786\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140389274407904\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140389355508263\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140431828824371\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140448122410568\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140482916501310\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140491231331543\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140499827729550\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140621259019789\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140752315422991\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=140904544427729\u0026w=2"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/Dec/23"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58337"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58579"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58615"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58667"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58713"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58714"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58716"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58742"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58797"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58939"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58945"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/58977"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59120"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59126"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59162"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59167"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59175"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59189"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59191"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59192"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59223"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59264"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59282"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59284"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59287"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59300"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59301"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59306"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59310"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59340"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59342"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59362"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59364"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59365"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59413"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59431"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59437"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59438"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59440"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59441"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59442"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59445"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59449"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59450"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59451"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59459"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59460"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59483"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59490"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59491"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59495"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59514"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59518"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59525"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59655"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59659"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59666"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59669"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59721"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59784"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59895"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59916"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59990"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60571"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/61254"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201407-05.xml"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT6443"
},
{
"type": "WEB",
"url": "http://support.citrix.com/article/CTX140876"
},
{
"type": "WEB",
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15342.html"
},
{
"type": "WEB",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001841"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001843"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673137"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675626"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675821"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676035"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676062"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676071"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676419"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676496"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676501"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676529"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676615"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676655"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676879"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676889"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677527"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677695"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677828"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677836"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678167"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678289"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21683332"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037761"
},
{
"type": "WEB",
"url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754"
},
{
"type": "WEB",
"url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755"
},
{
"type": "WEB",
"url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756"
},
{
"type": "WEB",
"url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757"
},
{
"type": "WEB",
"url": "http://www.blackberry.com/btsc/KB36051"
},
{
"type": "WEB",
"url": "http://www.f-secure.com/en/web/labs_global/fsc-2014-6"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21676356"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21676793"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg24037783"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:105"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:106"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:062"
},
{
"type": "WEB",
"url": "http://www.novell.com/support/kb/doc.php?id=7015264"
},
{
"type": "WEB",
"url": "http://www.novell.com/support/kb/doc.php?id=7015300"
},
{
"type": "WEB",
"url": "http://www.openssl.org/news/secadv_20140605.txt"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/67898"
},
{
"type": "WEB",
"url": "http://www.splunk.com/view/SP-CAAAM2D"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0006.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
},
{
"type": "WEB",
"url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6060\u0026myns=phmc\u0026mync=E"
},
{
"type": "WEB",
"url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6061\u0026myns=phmc\u0026mync=E"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RQCF-MX7P-PRJX
Vulnerability from github – Published: 2025-10-24 18:30 – Updated: 2025-10-24 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
filemap: Handle sibling entries in filemap_get_read_batch()
If a read races with an invalidation followed by another read, it is possible for a folio to be replaced with a higher-order folio. If that happens, we'll see a sibling entry for the new folio in the next iteration of the loop. This manifests as a NULL pointer dereference while holding the RCU read lock.
Handle this by simply returning. The next call will find the new folio and handle it correctly. The other ways of handling this rare race are more complex and it's just not worth it.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-49699"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: Handle sibling entries in filemap_get_read_batch()\n\nIf a read races with an invalidation followed by another read, it is\npossible for a folio to be replaced with a higher-order folio. If that\nhappens, we\u0027ll see a sibling entry for the new folio in the next iteration\nof the loop. This manifests as a NULL pointer dereference while holding\nthe RCU read lock.\n\nHandle this by simply returning. The next call will find the new folio\nand handle it correctly. The other ways of handling this rare race are\nmore complex and it\u0027s just not worth it.",
"id": "GHSA-rqcf-mx7p-prjx",
"modified": "2025-10-24T18:30:56Z",
"published": "2025-10-24T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49699"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a66f131d30e53000f08301776bf85c912ef47aad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb995f4eeba9d268fd4b56c2423ad6c1d1ea1b82"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQCV-9R22-6RFM
Vulnerability from github – Published: 2025-06-06 18:30 – Updated: 2025-06-18 18:30
VLAI
Details
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later
Severity
{
"affected": [],
"aliases": [
"CVE-2025-29873"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T16:15:24Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following version:\nFile Station 5 5.5.6.4847 and later",
"id": "GHSA-rqcv-9r22-6rfm",
"modified": "2025-06-18T18:30:31Z",
"published": "2025-06-06T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29873"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-25-16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RQG9-48MQ-4PM8
Vulnerability from github – Published: 2024-10-21 18:30 – Updated: 2024-10-24 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw
This commit addresses a potential null pointer dereference issue in the
dcn401_init_hw function. The issue could occur when dc->clk_mgr or
dc->clk_mgr->funcs is null.
The fix adds a check to ensure dc->clk_mgr and dc->clk_mgr->funcs is
not null before accessing its functions. This prevents a potential null
pointer dereference.
Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 225)
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-49916"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T18:15:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr-\u003efuncs in dcn401_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn401_init_hw` function. The issue could occur when `dc-\u003eclk_mgr` or\n`dc-\u003eclk_mgr-\u003efuncs` is null.\n\nThe fix adds a check to ensure `dc-\u003eclk_mgr` and `dc-\u003eclk_mgr-\u003efuncs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed \u0027dc-\u003eclk_mgr\u0027 could be null (see line 225)",
"id": "GHSA-rqg9-48mq-4pm8",
"modified": "2024-10-24T18:30:41Z",
"published": "2024-10-21T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49916"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ac1c41e318074d8a9ea925787e366be15d7645e8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQGX-3Q58-H4H3
Vulnerability from github – Published: 2024-09-18 09:30 – Updated: 2024-09-23 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX
If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX.
~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
Fix this by using actual TX queues instead of max TX queues when picking the TX channel in am65_cpsw_ndo_xdp_xmit().
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-46799"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:06Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX\n\nIf number of TX queues are set to 1 we get a NULL pointer\ndereference during XDP_TX.\n\n~# ethtool -L eth0 tx 1\n~# ./xdp-trafficgen udp -A \u003cipv6-src\u003e -a \u003cipv6-dst\u003e eth0 -t 2\nTransmitting on eth0 (ifindex 2)\n[ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n\nFix this by using actual TX queues instead of max TX queues\nwhen picking the TX channel in am65_cpsw_ndo_xdp_xmit().",
"id": "GHSA-rqgx-3q58-h4h3",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-18T09:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46799"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0a50c35277f96481a5a6ed5faf347f282040c57d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2e7189d2b1de51fc2567676cd4f96c0fe0960b9f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQH7-Q69F-F8VQ
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-17 00:01
VLAI
Details
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-0433"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T17:44:00Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference flaw was found in the Linux kernel\u0027s BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.",
"id": "GHSA-rqh7-q69f-f8vq",
"modified": "2022-03-17T00:01:38Z",
"published": "2022-03-11T00:02:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0433"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2048259"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/bpf/1640776802-22421-1-git-send-email-tcs.kernel@gmail.com/t"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQHV-2428-CQ32
Vulnerability from github – Published: 2022-08-06 00:00 – Updated: 2022-08-06 00:00
VLAI
Details
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a null pointer, which may lead to denial of service.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-31618"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-05T21:15:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a null pointer, which may lead to denial of service.",
"id": "GHSA-rqhv-2428-cq32",
"modified": "2022-08-06T00:00:36Z",
"published": "2022-08-06T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31618"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Requirements
Select a programming language that is not susceptible to these issues.
Mitigation
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.