CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6472 vulnerabilities reference this CWE, most recent first.
GHSA-8WGP-584R-M465
Vulnerability from github – Published: 2022-04-29 01:27 – Updated: 2024-01-09 03:30xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.
{
"affected": [],
"aliases": [
"CVE-2003-1000"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-01-05T05:00:00Z",
"severity": "MODERATE"
},
"details": "xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.",
"id": "GHSA-8wgp-584r-m465",
"modified": "2024-01-09T03:30:19Z",
"published": "2022-04-29T01:27:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1000"
},
{
"type": "WEB",
"url": "http://mail.nl.linux.org/xchat-announce/2003-12/msg00000.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=107152093419276\u0026w=2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WQQ-45FP-2XMP
Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 15:32Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.
X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.
A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.
{
"affected": [],
"aliases": [
"CVE-2026-58101"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T23:16:47Z",
"severity": "HIGH"
},
"details": "Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.\n\nX509V3_EXT_d2i(ext) returns NULL when an extension\u0027s DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid-\u003ekeyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds.\n\nA caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.",
"id": "GHSA-8wqq-45fp-2xmp",
"modified": "2026-07-14T15:32:11Z",
"published": "2026-07-14T00:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58101"
},
{
"type": "WEB",
"url": "https://github.com/dsully/perl-crypt-openssl-x509/commit/4c1e2370556097c253ae27abe9e1097ea377fbd2.patch"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-X509-2.1.3/source/Changes.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WR8-FQCF-723V
Vulnerability from github – Published: 2025-03-17 18:31 – Updated: 2025-03-17 18:31In the Linux kernel, the following vulnerability has been resolved:
drm/msm/hdmi: check return value after calling platform_get_resource_byname()
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
Patchwork: https://patchwork.freedesktop.org/patch/482992/
{
"affected": [],
"aliases": [
"CVE-2022-49495"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:25Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/hdmi: check return value after calling platform_get_resource_byname()\n\nIt will cause null-ptr-deref if platform_get_resource_byname() returns NULL,\nwe need check the return value.\n\nPatchwork: https://patchwork.freedesktop.org/patch/482992/",
"id": "GHSA-8wr8-fqcf-723v",
"modified": "2025-03-17T18:31:51Z",
"published": "2025-03-17T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49495"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0978fcce91b90b561b8c82e7c492ba9fc8440eef"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2b3ed7547b1a052209da6c4ab886ffe0eed88c42"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4cd66a8016b872a153bf892fe4258cbc0dacf5b1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6369dda4a2209142ab819f01d3d2076d81e3ebdd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9cb1ee33efccb8b107ee04b7b3441820de3fd2da"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9f5495a5c51c1d11c6ffc13aa2befffec0c2651a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a36e506711548df923ceb7ec9f6001375be799a5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c1bfacf0daf25a5fc7d667399d6ff2dffda84cd8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d9cb951d11a4ace4de5c50b1178ad211de17079e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WRH-CH6P-2682
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-04 15:30In the Linux kernel, the following vulnerability has been resolved:
hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
Syzkaller reports a null-ptr-deref bug as follows:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380 [...] Call Trace: vfs_parse_fs_param fs/fs_context.c:148 [inline] vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129 vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191 generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231 do_new_mount fs/namespace.c:3036 [inline] path_mount+0x12de/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] ======================================================
According to commit "vfs: parse: deal with zero length string value", kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs string has zero length.
Yet the problem is that, hugetlbfs_parse_param() will dereference the param->string, without checking whether it is a null pointer. To be more specific, if hugetlbfs_parse_param() parses an illegal mount parameter, such as "size=,", kernel will constructs struct fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.
This patch solves it by adding sanity check on param->string in hugetlbfs_parse_param().
{
"affected": [],
"aliases": [
"CVE-2022-50334"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:45Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()\n\nSyzkaller reports a null-ptr-deref bug as follows:\n======================================================\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380\n[...]\nCall Trace:\n \u003cTASK\u003e\n vfs_parse_fs_param fs/fs_context.c:148 [inline]\n vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129\n vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191\n generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231\n do_new_mount fs/namespace.c:3036 [inline]\n path_mount+0x12de/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n \u003c/TASK\u003e\n======================================================\n\nAccording to commit \"vfs: parse: deal with zero length string value\",\nkernel will set the param-\u003estring to null pointer in vfs_parse_fs_string()\nif fs string has zero length.\n\nYet the problem is that, hugetlbfs_parse_param() will dereference the\nparam-\u003estring, without checking whether it is a null pointer. To be more\nspecific, if hugetlbfs_parse_param() parses an illegal mount parameter,\nsuch as \"size=,\", kernel will constructs struct fs_parameter with null\npointer in vfs_parse_fs_string(), then passes this struct fs_parameter to\nhugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.\n\nThis patch solves it by adding sanity check on param-\u003estring\nin hugetlbfs_parse_param().",
"id": "GHSA-8wrh-ch6p-2682",
"modified": "2025-12-04T15:30:31Z",
"published": "2025-09-15T15:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50334"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/26215b7ee923b9251f7bb12c4e5f09dc465d35f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/965e8f8ae0f642b5528f5a82b7bcaf15a659d5bd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9a8862820cbf1f18dca4f3b4c289d88561b3a384"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dcd28191be9bbf307ba51a5b485773a55b0037c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f2207145693ae5697a7b59e2add4b92f9e5b0e3c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa71639873518e3587632ae58e25e4a96b57fa90"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WRR-6RRG-3VCH
Vulnerability from github – Published: 2025-09-18 18:30 – Updated: 2025-12-12 18:30In the Linux kernel, the following vulnerability has been resolved:
parisc: led: Fix potential null-ptr-deref in start_task()
start_task() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may happen:
start_task() create_singlethread_workqueue() # failed, led_wq is NULL queue_delayed_work() queue_delayed_work_on() __queue_delayed_work() # warning here, but continue __queue_work() # access wq->flags, null-ptr-deref
Check the ret value and return -ENOMEM if it is NULL.
{
"affected": [],
"aliases": [
"CVE-2022-50415"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-18T16:15:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: led: Fix potential null-ptr-deref in start_task()\n\nstart_task() calls create_singlethread_workqueue() and not checked the\nret value, which may return NULL. And a null-ptr-deref may happen:\n\nstart_task()\n create_singlethread_workqueue() # failed, led_wq is NULL\n queue_delayed_work()\n queue_delayed_work_on()\n __queue_delayed_work() # warning here, but continue\n __queue_work() # access wq-\u003eflags, null-ptr-deref\n\nCheck the ret value and return -ENOMEM if it is NULL.",
"id": "GHSA-8wrr-6rrg-3vch",
"modified": "2025-12-12T18:30:28Z",
"published": "2025-09-18T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50415"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3505c187b86136250b39e62c72a3a70435277af6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/41f563ab3c33698bdfc3403c7c2e6c94e73681e4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5e4500454d75dd249be4695d83afa3ba0724c37e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/67c98fec87ed76b1feb2ae810051afd88dfa9df6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/77f8b628affaec692d83ad8bfa3520db8a0cc493"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ac838c663ba1fd6bff35a817fd89a47ab55e88e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6db0c32f39684c89c97bc1ba1c9c4249ca09e48"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc307b2905a3dd75c50a53b4d87ac9c912fb7c4e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc6d0f65f22040c6cc8a5ce032bf90252629de50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WV8-M4G8-5449
Vulnerability from github – Published: 2022-05-14 03:28 – Updated: 2022-05-14 03:28In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, and SD 835, in a GNSS API function, a NULL pointer dereference can occur.
{
"affected": [],
"aliases": [
"CVE-2016-10449"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-18T14:29:00Z",
"severity": "CRITICAL"
},
"details": "In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, and SD 835, in a GNSS API function, a NULL pointer dereference can occur.",
"id": "GHSA-8wv8-m4g8-5449",
"modified": "2022-05-14T03:28:09Z",
"published": "2022-05-14T03:28:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10449"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2018-04-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103671"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WVV-CHWP-PRVW
Vulnerability from github – Published: 2023-05-02 06:30 – Updated: 2024-04-04 03:45Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
{
"affected": [],
"aliases": [
"CVE-2022-33304"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-02T06:15:09Z",
"severity": "HIGH"
},
"details": "Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.",
"id": "GHSA-8wvv-chwp-prvw",
"modified": "2024-04-04T03:45:26Z",
"published": "2023-05-02T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33304"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WW7-X5R5-3G8J
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 18:31In the Linux kernel, the following vulnerability has been resolved:
pstore: ram_core: fix incorrect success return when vmap() fails
In persistent_ram_vmap(), vmap() may return NULL on failure.
If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success.
Subsequent access to prz->buffer may dereference an invalid address and cause crashes.
Add proper NULL checking for vmap() failures.
{
"affected": [],
"aliases": [
"CVE-2026-43124"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:29Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: ram_core: fix incorrect success return when vmap() fails\n\nIn persistent_ram_vmap(), vmap() may return NULL on failure.\n\nIf offset is non-zero, adding offset_in_page(start) causes the function\nto return a non-NULL pointer even though the mapping failed.\npersistent_ram_buffer_map() therefore incorrectly returns success.\n\nSubsequent access to prz-\u003ebuffer may dereference an invalid address\nand cause crashes.\n\nAdd proper NULL checking for vmap() failures.",
"id": "GHSA-8ww7-x5r5-3g8j",
"modified": "2026-05-08T18:31:26Z",
"published": "2026-05-06T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43124"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/05363abc7625cf18c96e67f50673cd07f11da5e9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1da904e84de608907662ad8a51ba9c571d61e003"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/49918dd52615097529811d21ec6074dd02ebe77c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88d5b28f63c7aac1271784e3b800ed405d1cde75"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8baa234181f632cabacf73e4834a910859e9fcc9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8d849adfbc3e98417fb541620568db1a759ef441"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d47234840aeb4182ed3ee795c578b1dfa9cbd25b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X2C-32P7-VM7C
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-08-13 15:34In the Linux kernel, the following vulnerability has been resolved:
kho: skip KHO for crash kernel
kho_fill_kimage() unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address:
Unable to handle kernel paging request at virtual address xxxxxxxx ... fdt_offset_ptr+... fdt_check_node_offset_+... fdt_first_property_offset+... fdt_get_property_namelen_+... fdt_getprop+... kho_memory_init+... mm_core_init+... start_kernel+...
kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH images, but kho_fill_kimage() was missing the same guard. As kho_fill_kimage() is the single point that populates image->kho.fdt and image->kho.scratch, fixing it here is sufficient for both arm64 and x86 as the FDT and boot_params path are bailing out when these fields are unset.
{
"affected": [],
"aliases": [
"CVE-2026-64167"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:58Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkho: skip KHO for crash kernel\n\nkho_fill_kimage() unconditionally populates the kimage with KHO\nmetadata for every kexec image type. When the image is a crash kernel,\nthis can be problematic as the crash kernel can run in a small reserved\nregion and the KHO scratch areas can sit outside it.\nThe crash kernel then faults during kho_memory_init() when it\ntries phys_to_virt() on the KHO FDT address:\n\n Unable to handle kernel paging request at virtual address xxxxxxxx\n ...\n fdt_offset_ptr+...\n fdt_check_node_offset_+...\n fdt_first_property_offset+...\n fdt_get_property_namelen_+...\n fdt_getprop+...\n kho_memory_init+...\n mm_core_init+...\n start_kernel+...\n\nkho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH\nimages, but kho_fill_kimage() was missing the same guard. As\nkho_fill_kimage() is the single point that populates image-\u003ekho.fdt\nand image-\u003ekho.scratch, fixing it here is sufficient for both arm64\nand x86 as the FDT and boot_params path are bailing out when these\nfields are unset.",
"id": "GHSA-8x2c-32p7-vm7c",
"modified": "2026-08-13T15:34:16Z",
"published": "2026-07-19T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64167"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6715d7ec472a476db17787697a4abda62962284"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6ac6721326a75ff2d14c68db05f93b576d8762f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X2M-VWXP-R65J
Vulnerability from github – Published: 2024-04-10 18:30 – Updated: 2024-04-10 18:30A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.
This affects the following hardware firewall models: - PA-5400 Series firewalls - PA-7000 Series firewalls
{
"affected": [],
"aliases": [
"CVE-2024-3385"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T17:15:57Z",
"severity": "HIGH"
},
"details": "A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.\n\nThis affects the following hardware firewall models:\n- PA-5400 Series firewalls\n- PA-7000 Series firewalls",
"id": "GHSA-8x2m-vwxp-r65j",
"modified": "2024-04-10T18:30:48Z",
"published": "2024-04-10T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3385"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2024-3385"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.