NULL Pointer Dereference Affecting kernel-kvmsmall package, versions <6.12.0-160000.37.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES1600-KERNELKVMSMALL-19328718
- published27 Aug 2026
- disclosed11 Aug 2026
Introduced: 11 Aug 2026
NewCVE-2026-53382 (opens in a new tab)How to fix?
Upgrade SLES:16.0.0 kernel-kvmsmall to version 6.12.0-160000.37.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-kvmsmall package and not the kernel-kvmsmall package as distributed by SLES.
See How to fix? for SLES:16.0.0 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
syzbot reported a general protection fault in vidtv_psi_ts_psi_write_into [1].
vidtv_mux_get_pid_ctx() can return NULL, but vidtv_mux_push_si() does not check for this before dereferencing the returned pointer to access the continuity counter. This leads to a general protection fault when accessing a near-NULL address.
The root cause is that vidtv_mux_pid_ctx_init() does not check the return value of vidtv_mux_create_pid_ctx_once() for PMT section PIDs. If the allocation fails, the PID context is never created, but init returns success. The subsequent vidtv_mux_push_si() call then gets NULL from vidtv_mux_get_pid_ctx() and crashes.
Fix both the root cause (add error check in vidtv_mux_pid_ctx_init for PMT PIDs) and add defensive NULL checks in vidtv_mux_push_si for all vidtv_mux_get_pid_ctx() calls.
[1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events vidtv_mux_tick RIP: 0010:vidtv_psi_ts_psi_write_into+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197 Call Trace: <TASK> vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline] vidtv_psi_pmt_write_into+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231 vidtv_mux_push_si+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtv_mux.c:196 vidtv_mux_tick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtv_mux.c:408
References
- https://www.suse.com/security/cve/CVE-2026-53382.html
- https://bugzilla.suse.com/1271717
- https://git.kernel.org/stable/c/232e4b313ea342672edf8947e067c0de4328405b
- https://git.kernel.org/stable/c/353d9578951dd38bc9679308f5b618ceed1f20fa
- https://git.kernel.org/stable/c/455bc12e7b73ab5a2dfcb47822e91e772bc6c42e
- https://git.kernel.org/stable/c/6df7e16d4f742c80add58995a6e69385b97aa9e6
- https://git.kernel.org/stable/c/7d8bf3d8f91073f4db347ed3aa6302b56107499c
- https://git.kernel.org/stable/c/b28b12be6e8910489e6800ed93ea4d41dfe19683
- https://git.kernel.org/stable/c/cd923dadefadb9671b5ac341b672ff424d429c39
- https://git.kernel.org/stable/c/f0f5a1d7056980a0d512456fdb370cfb72bba86a
- https://git.kernel.org/stable/c/f965cf22dda7f512f4922415894c3e528269a4ae