Homepage

NULL Pointer Dereference Affecting kernel-uek-modules-wireless package, versions <0:6.12.0-203.76.7.5.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.4% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about NULL Pointer Dereference vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ORACLE9-KERNELUEKMODULESWIRELESS-17375641
  • published18 Jun 2026
  • disclosed24 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 24 Apr 2026

CVE-2026-31657  (opens in a new tab)
CWE-476  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-modules-wireless to version 0:6.12.0-203.76.7.5.el9uek or higher.
This issue was patched in ELSA-2026-50319.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-modules-wireless package and not the kernel-uek-modules-wireless package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: hold claim backbone gateways by reference

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.

The netlink claim dump path dereferences claim->backbone_gw->orig and takes claim->backbone_gw->crc_lock without pinning the underlying backbone gateway. batadv_bla_check_claim() still has the same naked pointer access pattern.

Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate on a stable gateway reference until the read-side work is complete. This keeps the dump and claim-check paths aligned with the lifetime rules introduced for the other BLA claim readers.