CVE-2026-19411 PUBLISHED

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

Assigner: redhat
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 10.08.2026

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
CVSS Score: 3.9

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: unknown

Workarounds

The code could be modified to include NULL pointer checkers in the code. Before DevicePathToStr : "if (li == NULL || li->FilePath == NULL) return 0;" After DevicePathToStr : "if (bootpath == NULL) return 0;" At error: "if (bootpath != NULL)"

References

Problem Types

  • NULL Pointer Dereference CWE