Linux: NULL Pointer Dereference
CVE-2026-45958 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 13537f7f6d28a87ee2e496e071b6ad9541905f23, c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c, 7efb6a4e6b1b523e744d17e6249757ed97caae7c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 13537f7f6d28a87ee2e496e071b6ad9541905f23 or c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c or 7efb6a4e6b1b523e744d17e6249757ed97caae7c or 2e147aa3169b83eaf044776f81d86235bf147de1, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 13537f7f6d28a87ee2e496e071b6ad9541905f23; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 7efb6a4e6b1b523e744d17e6249757ed97caae7c; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 2e147aa3169b83eaf044776f81d86235bf147de1; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 4c4193829109f38b2855de77981adc2e066286c7; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 4949e32387fe315b59ad5f422c9fc52836fbdd1e; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, 235d702b771416b8a61e81bb09ba39282e4268fd; b73d12303ecfc91123363d8900e127da44bf42a6 up to, but not including, d4c98c077c7fb2dfdece7d605e694b5ea2665085; and 1 more ranges | 13537f7f6d28a87ee2e496e071b6ad9541905f23, c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c, 7efb6a4e6b1b523e744d17e6249757ed97caae7c, 2e147aa3169b83eaf044776f81d86235bf147de1, 4c4193829109f38b2855de77981adc2e066286c7, 4949e32387fe315b59ad5f422c9fc52836fbdd1e |
| Linux | Linux Kernel | 3.4 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.77; 6.13 up to, but not including, 6.18.14; 6.19 up to, but not including, 6.19.4 | 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.14 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: fix to avoid directly dereferencing user pointer In vidi_connection_ioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copy_from_user() and use it.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How developers prevent this class of flaw
- For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
- Select a programming language that is not susceptible to these issues.
- Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/13537f7f6d28a87ee2e496e071b6ad9541905f23
- git.kernel.org/stable/c/235d702b771416b8a61e81bb09ba39282e4268fd
- git.kernel.org/stable/c/2e147aa3169b83eaf044776f81d86235bf147de1
- git.kernel.org/stable/c/4949e32387fe315b59ad5f422c9fc52836fbdd1e
- git.kernel.org/stable/c/4c4193829109f38b2855de77981adc2e066286c7
- git.kernel.org/stable/c/7efb6a4e6b1b523e744d17e6249757ed97caae7c
- git.kernel.org/stable/c/c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c
- git.kernel.org/stable/c/d4c98c077c7fb2dfdece7d605e694b5ea2665085
Recent NULL Pointer Dereference vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.