CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2023-53280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-16T08:15:36Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Remove unused nvme_ls_waitq wait queue\n\nSystem crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up\ngets called for uninitialized wait queue sp-\u003envme_ls_waitq.\n\n    qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0\n    qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11\n    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n    PGD 0 P4D 0\n    Oops: 0000 [#1] SMP NOPTI\n    Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n    Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n    RIP: 0010:__wake_up_common+0x4c/0x190\n    RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n    RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n    RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n    RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n    R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n    R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n    FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    PKRU: 55555554\n    Call Trace:\n     __wake_up_common_lock+0x7c/0xc0\n     qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n     ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n     ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n     ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n\nRemove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed\npreviously in the commits tagged Fixed: below.",
  "id": "GHSA-3x66-jhf4-g79q",
  "modified": "2025-12-02T21:31:26Z",
  "published": "2025-09-16T15:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53280"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b1ce92fabdb7d02ddf8641230a06e2752ae5baa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/20fce500b232b970e40312a9c97e7f3b6d7a709c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/522ee1b3030f3b6b5fd59489d12b4ca767c9e5da"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/92529387a0066754fd9cda080fb3298b8cca750c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7084ebf4f54d46fed5153112d685f4137334175"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f459d586fdf12c53116c9fddf43065165fdd5969"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-02T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.",
  "id": "GHSA-3x6m-jc93-26vq",
  "modified": "2022-06-14T00:00:35Z",
  "published": "2022-06-03T00:01:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29694"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/issues/1588"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/pull/1593/commits/31389e59457f304be3809f9679f91a42daa7ebaa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/pull/1593/commits/6a879a082d4d67a5d13f1233ae0334cde0a7f844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unicorn-engine/unicorn/commit/3d3deac5e6d38602b689c4fef5dac004f07a2e63"
    },
    {
      "type": "WEB",
      "url": "https://violentbinary.github.io/posts/2-simple-analysis-of-software-virtualization-of-memory-in-unicorn-engine"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-47753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T13:15:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix VP8 stateless decoder smatch warning\n\nFix a smatch static checker warning on vdec_vp8_req_if.c.\nWhich leads to a kernel crash when fb is NULL.",
  "id": "GHSA-3x9w-fg96-5j98",
  "modified": "2025-11-03T21:31:22Z",
  "published": "2024-10-21T15:32:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47753"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3167aa42941b68405a092df114453ef0f1b09c2c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35cc704622b3a9bc02a4755d5ba80238eee3cdc2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e0713c79cf5d0b549fa855e230ade1ff83c27d7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b113bc7c0e83b32f4dd2d291a2b6c4803e0a2c44"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dbe5b7373801c261f3ea118145fbb2caac5f9324"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-47610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T15:15:55Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix null ptr access msm_ioctl_gem_submit()\n\nFix the below null pointer dereference in msm_ioctl_gem_submit():\n\n 26545.260705:   Call trace:\n 26545.263223:    kref_put+0x1c/0x60\n 26545.266452:    msm_ioctl_gem_submit+0x254/0x744\n 26545.270937:    drm_ioctl_kernel+0xa8/0x124\n 26545.274976:    drm_ioctl+0x21c/0x33c\n 26545.278478:    drm_compat_ioctl+0xdc/0xf0\n 26545.282428:    __arm64_compat_sys_ioctl+0xc8/0x100\n 26545.287169:    el0_svc_common+0xf8/0x250\n 26545.291025:    do_el0_svc_compat+0x28/0x54\n 26545.295066:    el0_svc_compat+0x10/0x1c\n 26545.298838:    el0_sync_compat_handler+0xa8/0xcc\n 26545.303403:    el0_sync_compat+0x188/0x1c0\n 26545.307445:   Code: d503201f d503201f 52800028 4b0803e8 (b8680008)\n 26545.318799:   Kernel panic - not syncing: Oops: Fatal exception",
  "id": "GHSA-3xcp-65mf-qfv3",
  "modified": "2024-08-27T18:31:35Z",
  "published": "2024-06-19T15:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47610"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26d776fd0f79f093a5d0ce1a4c7c7a992bc3264c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6db3d98f876870c35e96693cfd54752f6199e59"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-48857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T19:15:31Z",
    "severity": "HIGH"
  },
  "details": "NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.",
  "id": "GHSA-3xg4-9379-gq7p",
  "modified": "2025-01-14T21:31:47Z",
  "published": "2025-01-14T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48857"
    },
    {
      "type": "WEB",
      "url": "https://support.blackberry.com/pkb/s/article/140334"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-53245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:51Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix handling of virtual Fibre Channel timeouts\n\nHyper-V provides the ability to connect Fibre Channel LUNs to the host\nsystem and present them in a guest VM as a SCSI device. I/O to the vFC\ndevice is handled by the storvsc driver. The storvsc driver includes a\npartial integration with the FC transport implemented in the generic\nportion of the Linux SCSI subsystem so that FC attributes can be displayed\nin /sys.  However, the partial integration means that some aspects of vFC\ndon\u0027t work properly. Unfortunately, a full and correct integration isn\u0027t\npractical because of limitations in what Hyper-V provides to the guest.\n\nIn particular, in the context of Hyper-V storvsc, the FC transport timeout\nfunction fc_eh_timed_out() causes a kernel panic because it can\u0027t find the\nrport and dereferences a NULL pointer. The original patch that added the\ncall from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this\nregard.\n\nIn many cases a timeout is due to a transient condition, so the situation\ncan be improved by just continuing to wait like with other I/O requests\nissued by storvsc, and avoiding the guaranteed panic. For a permanent\nfailure, continuing to wait may result in a hung thread instead of a panic,\nwhich again may be better.\n\nSo fix the panic by removing the storvsc call to fc_eh_timed_out().  This\nallows storvsc to keep waiting for a response.  The change has been tested\nby users who experienced a panic in fc_eh_timed_out() due to transient\ntimeouts, and it solves their problem.\n\nIn the future we may want to deprecate the vFC functionality in storvsc\nsince it can\u0027t be fully fixed. But it has current users for whom it is\nworking well enough, so it should probably stay for a while longer.",
  "id": "GHSA-3xmr-hc67-565w",
  "modified": "2025-12-03T21:31:00Z",
  "published": "2025-09-15T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53245"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/048ebc9a28fb918ee635dd4b2fcf4248eb6e4050"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1678408d08f31a694d5150a56796dd04c9710b22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/175544ad48cbf56affeef2a679c6a4d4fb1e2881"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/311db605e07f0d4fc0cc7ddb74f1e5692ea2f469"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/763c06565055ae373fe7f89c11e1447bd1ded264"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a792b3d888aab2c65389f9f4f9f2f6c000b1a0d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd87f4df9865a53807001ed12c0f0420b14ececd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed70fa5629a8b992a5372d7044d1db1f8fa6de29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-47003"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-16T05:15:29Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted.",
  "id": "GHSA-3xmr-xg4j-24rr",
  "modified": "2023-11-21T03:30:25Z",
  "published": "2023-11-16T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47003"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RedisGraph/RedisGraph/issues/3063"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-2036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-13T16:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The getURL function in drivers/secfilter/urlparser.c in secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to trigger a NULL pointer dereference via a \"GET HTTP/1.1\" request, aka SVE-2016-5036.",
  "id": "GHSA-3xp5-x55c-8fj2",
  "modified": "2022-05-17T02:48:34Z",
  "published": "2022-05-17T02:48:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2036"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ud2/advisories/tree/master/android/samsung/nocve-2016-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-29T16:15:00Z",
    "severity": "LOW"
  },
  "details": "A NULL pointer dereference flaw was found in pesign\u0027s cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.",
  "id": "GHSA-3xpm-4m85-6353",
  "modified": "2022-05-12T00:01:52Z",
  "published": "2022-04-30T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1249"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2065771"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14863"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-29T01:34:00Z",
    "severity": "MODERATE"
  },
  "details": "A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.",
  "id": "GHSA-3xr7-8857-qq4j",
  "modified": "2022-05-13T01:43:31Z",
  "published": "2022-05-13T01:43:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14863"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1494443"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}