CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6325 vulnerabilities reference this CWE, most recent first.
GHSA-2X7C-W8P7-47F7
Vulnerability from github – Published: 2024-12-25 18:30 – Updated: 2025-04-25 18:31OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.
{
"affected": [],
"aliases": [
"CVE-2024-56430"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-25T18:15:22Z",
"severity": "MODERATE"
},
"details": "OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.",
"id": "GHSA-2x7c-w8p7-47f7",
"modified": "2025-04-25T18:31:10Z",
"published": "2024-12-25T18:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56430"
},
{
"type": "WEB",
"url": "https://github.com/UnionTech-Software/openfhe-PoC"
},
{
"type": "WEB",
"url": "https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-base-scheme.cpp#L307-L308"
},
{
"type": "WEB",
"url": "https://github.com/openfheorg/openfhe-development/releases/tag/v1.2.3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/25/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2X8X-5R7X-JCGH
Vulnerability from github – Published: 2025-05-09 09:33 – Updated: 2025-11-12 21:31In the Linux kernel, the following vulnerability has been resolved:
pds_core: make wait_context part of q_info
Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up.
There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth.
{
"affected": [],
"aliases": [
"CVE-2025-37886"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-09T07:16:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth.",
"id": "GHSA-2x8x-5r7x-jcgh",
"modified": "2025-11-12T21:31:03Z",
"published": "2025-05-09T09:33:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37886"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XCF-7W6Q-9VXC
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-24 18:32In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
cros_typec_register_thunderbolt() missed initializing the adata->lock
mutex. This leads to a NULL dereference when the mutex is later
acquired (e.g. in cros_typec_altmode_work()).
Initialize the mutex in cros_typec_register_thunderbolt() to fix the issue.
{
"affected": [],
"aliases": [
"CVE-2026-46134"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:28Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration\n\ncros_typec_register_thunderbolt() missed initializing the `adata-\u003elock`\nmutex. This leads to a NULL dereference when the mutex is later\nacquired (e.g. in cros_typec_altmode_work()).\n\nInitialize the mutex in cros_typec_register_thunderbolt() to fix the\nissue.",
"id": "GHSA-2xcf-7w6q-9vxc",
"modified": "2026-06-24T18:32:33Z",
"published": "2026-05-28T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46134"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/23ae72e8c2f1c1d1da8cbd479320ddcfcc9c7435"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3b13d5883a097f538fccbab1c61c95546d29621f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/525cb7ba6661074c1c5cc3772bccc6afab6791ef"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XCH-4R76-8CGW
Vulnerability from github – Published: 2024-10-21 15:32 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
KEYS: prevent NULL pointer dereference in find_asymmetric_key()
In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2} arguments, the kernel will first emit WARN but then have an oops because id_2 gets dereferenced anyway.
Add the missing id_2 check and move WARN_ON() to the final else branch to avoid duplicate NULL checks.
Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
{
"affected": [],
"aliases": [
"CVE-2024-47743"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T13:15:04Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: prevent NULL pointer dereference in find_asymmetric_key()\n\nIn find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2}\narguments, the kernel will first emit WARN but then have an oops\nbecause id_2 gets dereferenced anyway.\n\nAdd the missing id_2 check and move WARN_ON() to the final else branch\nto avoid duplicate NULL checks.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.",
"id": "GHSA-2xch-4r76-8cgw",
"modified": "2025-11-04T00:31:38Z",
"published": "2024-10-21T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47743"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0d3b0706ada15c333e6f9faf19590ff715e45d1e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/13b5b401ead95b5d8266f64904086c55b6024900"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3322fa8f2aa40b0b3651034cd541647a600cc6c0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/70fd1966c93bf3bfe3fe6d753eb3d83a76597eef"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a3765b497a4f5224cb2f7a6a2d3357d3066214ee"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XCP-78PQ-JQQ3
Vulnerability from github – Published: 2024-07-29 18:30 – Updated: 2025-10-07 18:31In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Check pat.ops before dumping PAT settings
We may leave pat.ops unset when running on brand new platform or when running as a VF. While the former is unlikely, the latter is valid (future) use case and will cause NPD when someone will try to dump PAT settings by debugfs.
It's better to check pointer to pat.ops instead of specific .dump hook, as we have this hook always defined for every .ops variant.
{
"affected": [],
"aliases": [
"CVE-2024-42091"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T18:15:11Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Check pat.ops before dumping PAT settings\n\nWe may leave pat.ops unset when running on brand new platform or\nwhen running as a VF. While the former is unlikely, the latter\nis valid (future) use case and will cause NPD when someone will\ntry to dump PAT settings by debugfs.\n\nIt\u0027s better to check pointer to pat.ops instead of specific .dump\nhook, as we have this hook always defined for every .ops variant.",
"id": "GHSA-2xcp-78pq-jqq3",
"modified": "2025-10-07T18:31:01Z",
"published": "2024-07-29T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42091"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/583ce246c7ff9edeb0de49130cdc3d45db8545cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a918e771e6fbe1fa68932af5b0cdf473e23090cc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XG7-VCHR-Q6Q4
Vulnerability from github – Published: 2021-12-23 00:01 – Updated: 2021-12-29 00:01An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and application crash.
{
"affected": [],
"aliases": [
"CVE-2021-45259"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-22T17:15:00Z",
"severity": "MODERATE"
},
"details": "An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and application crash.",
"id": "GHSA-2xg7-vchr-q6q4",
"modified": "2021-12-29T00:01:35Z",
"published": "2021-12-23T00:01:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45259"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/1986"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2XPR-GH65-3JVF
Vulnerability from github – Published: 2026-05-02 09:31 – Updated: 2026-06-01 18:31In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix pass-by-value structs causing MSAN warnings
vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, causing MSAN to report uninit-value warnings. While only vidtv_ts_null_write_into() has triggered a report so far, both functions share the same issue.
Fix by passing both structs by const pointer instead, avoiding the stack copy of the struct along with its MSAN shadow and origin metadata. The functions do not modify the structs, which is enforced by the const qualifier.
{
"affected": [],
"aliases": [
"CVE-2026-43058"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-02T07:16:20Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix pass-by-value structs causing MSAN warnings\n\nvidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their\nargument structs by value, causing MSAN to report uninit-value warnings.\nWhile only vidtv_ts_null_write_into() has triggered a report so far,\nboth functions share the same issue.\n\nFix by passing both structs by const pointer instead, avoiding the\nstack copy of the struct along with its MSAN shadow and origin metadata.\nThe functions do not modify the structs, which is enforced by the const\nqualifier.",
"id": "GHSA-2xpr-gh65-3jvf",
"modified": "2026-06-01T18:31:28Z",
"published": "2026-05-02T09:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43058"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1b2820c8a9887981634020db19f1a2425558b88e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/57b01d945ed68cebe486d495dadc4901a96d3aaa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5f8e73bde67e931468bc2a1860d78d72f0c6ba41"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d75a9ec5bdb8cf8382eaf8f8fe831ba7d58a9d4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a73f84a30975e6c4ae06efd500d31c82564dba10"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a876d72ceba7fe5444005239f363c105767e0ecf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/be57e52e27c7cbfb400a8f255e475cbcff242baa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c034d8094fee474eb94142c17643eee2919079b7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e3957eb26a3d570aefc6bb184fa8b8a1e9a4e508"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XR3-2R6G-CGX8
Vulnerability from github – Published: 2025-09-16 15:32 – Updated: 2025-12-02 21:31In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference.
This follows the same pattern used in dpu_encoder_update_topology() within the same file, which checks for NULL before using conn_state.
Patchwork: https://patchwork.freedesktop.org/patch/665188/
{
"affected": [],
"aliases": [
"CVE-2025-39820"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T13:15:58Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset\n\nThe drm_atomic_get_new_connector_state() can return NULL if the\nconnector is not part of the atomic state. Add a check to prevent\na NULL pointer dereference.\n\nThis follows the same pattern used in dpu_encoder_update_topology()\nwithin the same file, which checks for NULL before using conn_state.\n\nPatchwork: https://patchwork.freedesktop.org/patch/665188/",
"id": "GHSA-2xr3-2r6g-cgx8",
"modified": "2025-12-02T21:31:27Z",
"published": "2025-09-16T15:32:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39820"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aaec54254b02f5959c3670177037464d828b2140"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/abebfed208515726760d79cf4f9f1a76b9a10a84"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-322G-PXMJ-97CC
Vulnerability from github – Published: 2022-05-01 23:42 – Updated: 2022-05-01 23:42OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
{
"affected": [],
"aliases": [
"CVE-2008-1672"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-05-29T16:32:00Z",
"severity": "MODERATE"
},
"details": "OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses \"particular cipher suites,\" which triggers a NULL pointer dereference.",
"id": "GHSA-322g-pxmj-97cc",
"modified": "2022-05-01T23:42:23Z",
"published": "2022-05-01T23:42:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1672"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42667"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01029.html"
},
{
"type": "WEB",
"url": "http://cert.fi/haavoittuvuudet/2008/advisory-openssl.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30405"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30460"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30825"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30852"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30868"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31228"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31288"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200806-08.xml"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.562004"
},
{
"type": "WEB",
"url": "http://sourceforge.net/project/shownotes.php?release_id=615606"
},
{
"type": "WEB",
"url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL\u0026id=738400"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/520586"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:107"
},
{
"type": "WEB",
"url": "http://www.openssl.org/news/secadv_20080528.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/492932/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29405"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1020122"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-620-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1680"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1937/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-323G-Q36V-HMMC
Vulnerability from github – Published: 2026-05-07 06:31 – Updated: 2026-05-07 06:31Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.
{
"affected": [],
"aliases": [
"CVE-2026-44602"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-07T04:16:35Z",
"severity": "LOW"
},
"details": "Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.",
"id": "GHSA-323g-q36v-hmmc",
"modified": "2026-05-07T06:31:42Z",
"published": "2026-05-07T06:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44602"
},
{
"type": "WEB",
"url": "https://forum.torproject.org/c/news/tor-release-announcement/28"
},
{
"type": "WEB",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/df7d5174ef41814d806c8ede776e230cd30ac12b"
},
{
"type": "WEB",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41240"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.