CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2024-50146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T10:15:06Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don\u0027t call cleanup on profile rollback failure\n\nWhen profile rollback fails in mlx5e_netdev_change_profile, the netdev\nprofile var is left set to NULL. Avoid a crash when unloading the driver\nby not calling profile-\u003ecleanup in such a case.\n\nThis was encountered while testing, with the original trigger that\nthe wq rescuer thread creation got interrupted (presumably due to\nCtrl+C-ing modprobe), which gets converted to ENOMEM (-12) by\nmlx5e_priv_init, the profile rollback also fails for the same reason\n(signal still active) so the profile is left as NULL, leading to a crash\nlater in _mlx5e_remove.\n\n [  732.473932] mlx5_core 0000:08:00.1: E-Switch: Unload vfs: mode(OFFLOADS), nvfs(2), necvfs(0), active vports(2)\n [  734.525513] workqueue: Failed to create a rescuer kthread for wq \"mlx5e\": -EINTR\n [  734.557372] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12\n [  734.559187] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: new profile init failed, -12\n [  734.560153] workqueue: Failed to create a rescuer kthread for wq \"mlx5e\": -EINTR\n [  734.589378] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12\n [  734.591136] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n [  745.537492] BUG: kernel NULL pointer dereference, address: 0000000000000008\n [  745.538222] #PF: supervisor read access in kernel mode\n\u003csnipped\u003e\n [  745.551290] Call Trace:\n [  745.551590]  \u003cTASK\u003e\n [  745.551866]  ? __die+0x20/0x60\n [  745.552218]  ? page_fault_oops+0x150/0x400\n [  745.555307]  ? exc_page_fault+0x79/0x240\n [  745.555729]  ? asm_exc_page_fault+0x22/0x30\n [  745.556166]  ? mlx5e_remove+0x6b/0xb0 [mlx5_core]\n [  745.556698]  auxiliary_bus_remove+0x18/0x30\n [  745.557134]  device_release_driver_internal+0x1df/0x240\n [  745.557654]  bus_remove_device+0xd7/0x140\n [  745.558075]  device_del+0x15b/0x3c0\n [  745.558456]  mlx5_rescan_drivers_locked.part.0+0xb1/0x2f0 [mlx5_core]\n [  745.559112]  mlx5_unregister_device+0x34/0x50 [mlx5_core]\n [  745.559686]  mlx5_uninit_one+0x46/0xf0 [mlx5_core]\n [  745.560203]  remove_one+0x4e/0xd0 [mlx5_core]\n [  745.560694]  pci_device_remove+0x39/0xa0\n [  745.561112]  device_release_driver_internal+0x1df/0x240\n [  745.561631]  driver_detach+0x47/0x90\n [  745.562022]  bus_remove_driver+0x84/0x100\n [  745.562444]  pci_unregister_driver+0x3b/0x90\n [  745.562890]  mlx5_cleanup+0xc/0x1b [mlx5_core]\n [  745.563415]  __x64_sys_delete_module+0x14d/0x2f0\n [  745.563886]  ? kmem_cache_free+0x1b0/0x460\n [  745.564313]  ? lockdep_hardirqs_on_prepare+0xe2/0x190\n [  745.564825]  do_syscall_64+0x6d/0x140\n [  745.565223]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  745.565725] RIP: 0033:0x7f1579b1288b",
  "id": "GHSA-wxqq-8jjm-6pjm",
  "modified": "2025-11-03T21:31:33Z",
  "published": "2024-11-07T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50146"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3955b77494c3c7d14873b1db67e7e00c46a714db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4dbc1d1a9f39c3711ad2a40addca04d07d9ab5d0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d6fe973c8873c998734a050f366b28facc03d32a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db84cb4c8c565e6d4de84b23c2818b63991adfdd"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-24T16:15:11Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the Linux kernel\u0027s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.",
  "id": "GHSA-wxv8-6x37-53r6",
  "modified": "2024-08-27T21:31:10Z",
  "published": "2023-07-24T18:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32252"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-32252"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219815"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20231124-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-CAN-20590"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:30Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: check for PCI upstream bridge existence\n\npci_upstream_bridge() returns NULL if the device is on a root bus.  If\n8821CE is installed in the system with such a PCI topology, the probing\nroutine will crash.  This has probably been unnoticed as 8821CE is mostly\nsupplied in laptops where there is a PCI-to-PCI bridge located upstream\nfrom the device.  However the card might be installed on a system with\ndifferent configuration.\n\nCheck if the bridge does exist for the specific workaround to be applied.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.",
  "id": "GHSA-wxwq-c95x-686r",
  "modified": "2026-07-16T12:32:19Z",
  "published": "2026-05-27T15:33:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46092"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/000134a20bbf89b1152520a2eef71f91fdb83a5b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b89b4c095804c478d50376285e66700cf3c045f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3bbbb56204f7359ce2139a9341b43b52a186261c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c53d68e3bcfc8faccdd76c3383a9232b05c9ae6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/959c13da6c36167ce1016d400a6104d2367f686e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc9b6303e7ea91bc360b42c7edc1fe9ceb2f47fe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eb101d2abdcccb514ca4fccd3b278dd8267374f6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-02T15:16:00Z",
    "severity": "LOW"
  },
  "details": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.7.3256 build 20250913 and later\nQuTS hero h5.2.7.3256 build 20250913 and later\nQuTS hero h5.3.1.3250 build 20250912 and later",
  "id": "GHSA-wxwx-rghm-5hm2",
  "modified": "2026-01-05T21:30:29Z",
  "published": "2026-01-02T15:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52431"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-50"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-53335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-01T14:16:41Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/lru_sort: handle ctx allocation failure\n\nDAMON_LRU_SORT allocates the damon_ctx object for its kdamond in its init\nfunction.  damon_lru_sort_enabled_store() wrongly assumes the allocation\nwill always succeed once tried.  If the damon_ctx allocation was failed,\ntherefore, code execution reaches to damon_commit_ctx() while \u0027ctx\u0027 is\nNULL.  As a result, it dereferences the NULL \u0027ctx\u0027 pointer.  Avoid the\nNULL dereference by returning -ENOMEM if \u0027ctx\u0027 is NULL.",
  "id": "GHSA-wxxm-77v6-p8hq",
  "modified": "2026-07-24T00:32:32Z",
  "published": "2026-07-01T15:35:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53335"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d48f15659395bf1381114f01be91bc68e0be46a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab04340b5ae5d52c1d46b750538febcde9d889e7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/daab1996431a71f43219dcac48ecc9ad2aad3f1c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49615"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:36Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error\n\nThe initial settings will be written before the codec probe function.\nBut, the rt711-\u003ecomponent doesn\u0027t be assigned yet.\nIf IO error happened during initial settings operations, it will cause the kernel panic.\nThis patch changed component-\u003edev to slave-\u003edev to fix this issue.",
  "id": "GHSA-x236-j29m-67wp",
  "modified": "2025-03-12T00:31:46Z",
  "published": "2025-03-12T00:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49615"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1df793d479bef546569fc2e409ff8bb3f0fb8e99"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/269be8b2907378adf72d7347cfa43ef230351a06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7bb71133cae88d3003a3490b97864af76533072b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-41095"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T16:15:04Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes\n\nIn nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",
  "id": "GHSA-x274-3j7p-qfpp",
  "modified": "2025-11-04T00:31:04Z",
  "published": "2024-07-29T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41095"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0d17604f2e44b3df21e218fe8fb3b836d41bac49"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/259549b2ccf795b7f91f7b5aba47286addcfa389"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/66edf3fb331b6c55439b10f9862987b0916b3726"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9289cd3450d1da3e271ef4b054d4d2932c41243e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bdda5072494f2a7215d94fc4124ad1949a218714"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb751e48bbcffd292090f7882b23b215111b3d72"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dbd75f32252508ed6c46c3288a282c301a57ceeb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f95ed0f54b3d3faecae1140ddab854f904a6e7c8"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-65493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-24T14:15:46Z",
    "severity": "HIGH"
  },
  "details": "NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL.",
  "id": "GHSA-x2fc-9w3j-84r4",
  "modified": "2025-11-24T15:30:28Z",
  "published": "2025-11-24T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65493"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/issues/1743"
    },
    {
      "type": "WEB",
      "url": "https://github.com/obgm/libcoap/pull/1750"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-34044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-30T00:15:07Z",
    "severity": "MODERATE"
  },
  "details": "The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL.",
  "id": "GHSA-x2gp-p6cx-82p9",
  "modified": "2024-11-12T18:30:50Z",
  "published": "2024-04-30T00:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34044"
    },
    {
      "type": "WEB",
      "url": "https://jira.o-ran-sc.org/browse/RIC-1043"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-6292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-07-25T14:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.",
  "id": "GHSA-x2gq-qh39-x424",
  "modified": "2025-04-12T13:02:52Z",
  "published": "2022-05-14T03:56:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6292"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/72618"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201611-22"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT207170"
    },
    {
      "type": "WEB",
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=41131cd41d2fd2e0c2f332a27988df75659c42e4"
    },
    {
      "type": "WEB",
      "url": "http://git.php.net/?p=php-src.git;a=commit;h=41131cd41d2fd2e0c2f332a27988df75659c42e4"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2016/07/24/2"
    },
    {
      "type": "WEB",
      "url": "http://php.net/ChangeLog-5.php"
    },
    {
      "type": "WEB",
      "url": "http://php.net/ChangeLog-7.php"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3631"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/92078"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1036430"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}