rootpwn

medium · CVSS v3 5.5

CVE-2026-93286

This CVE addresses a NULL pointer dereference in the Linux kernel's AppleTalk implementation. The flaw occurs when a device without an Apple

Overview

This CVE addresses a NULL pointer dereference in the Linux kernel's AppleTalk implementation. The flaw occurs when a device without an AppleTalk interface invokes aarp_send_ddp, potentially causing a kernel crash. It matters because it can lead to denial of service on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalk_ptr == NULL), this leads to a NULL pointer dereference at the at->s_net access. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: atalk_sendmsg (net/appletalk/ddp.c:1715) __sys_sendto (net/socket.c:2265 (discriminator 1)) __x64_sys_sendto (net/socket.c:2272) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Add a NULL check consistent with the other callers of atalk_find_dev_addr().

Impact

The vulnerability can cause a kernel panic, leading to denial of service. It does not directly expose data or allow privilege escalation. Defenders should monitor for crashes and ensure AppleTalk is disabled if not needed.

Remediation

Apply the latest kernel update that includes the fix. If unable to update, disable the AppleTalk stack by setting atalk=off or removing atalk modules. Verify that atalk_find_dev_addr() is not called on devices lacking AppleTalk configuration.

Risk context

Medium severity; no EPSS data available. Patching is recommended but not urgent unless AppleTalk traffic is expected.

Affected products

  • Linux kernel
  • Ubuntu kernel
  • Red Hat Enterprise Linux kernel
  • Debian kernel
  • CentOS kernel
  • Fedora kernel
  • SUSE Linux Enterprise Server kernel
  • Oracle Linux kernel

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

kernel appletalk null-pointer denial-of-service linux network patch

← All CVEs

Related CVEs

medium

CVE-2026-93273

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594_regulator_probe(), the multi-phase configuration loop calls of_find_node_by_name() to find buck nodes by name, and of_get_parent() twice to navigate to the PMIC parent node. None of the acquired node references (np, intermediate parent, np_pmic_parent) are ever released via of_node_put(), causing a reference leak on every loop iteration. Additionally, of_find_node_by_name() can return NULL, but the result was immediately passed to of_node_full_name() and of_get_parent() without a NULL check, which could lead to a NULL pointer dereference. Fix this by: - Adding a NULL check for np after of_find_node_by_name() - Storing the intermediate parent node in a local variable np_parent - Calling of_node_put() on np, np_parent and np_pmic_parent at the end of each loop iteration

View analysis

medium

CVE-2026-93274

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure

View analysis

medium

CVE-2026-93276

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devm_regulator_get_exclusive() initialises the regulator with enable_count = 1, requiring the consumer to disable it before release. The devm disable action was previously only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enable_count, triggering a WARN_ON during regulator release on device removal. Fix this by always registering the devm disable action based on the actual enabled state via regulator_is_enabled(), regardless of whether the caller requested an explicit enable. This covers both the explicitly enabled case and the initial state set by devm_regulator_get_exclusive().

View analysis

medium

CVE-2026-93281

A buffer over-read in the Realtek rtw89 Wi‑Fi driver allows reading beyond the intended data length. The flaw occurs when the driver processes HE extended capabilities with insufficient length checks. This can lead to information disclosure or kernel crashes on affected systems.

View analysis