# Vulnerabilities published in 2026


- [CVE-2026-9930](https://insights.sbomify.com/CVE-2026-9930/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-9929](https://insights.sbomify.com/CVE-2026-9929/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-9928](https://insights.sbomify.com/CVE-2026-9928/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9927](https://insights.sbomify.com/CVE-2026-9927/): Use after free in Chrome (high 8.8)
- [CVE-2026-9926](https://insights.sbomify.com/CVE-2026-9926/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-9925](https://insights.sbomify.com/CVE-2026-9925/): Use after free in Chrome (high 8.3)
- [CVE-2026-9924](https://insights.sbomify.com/CVE-2026-9924/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-9923](https://insights.sbomify.com/CVE-2026-9923/): Use after free in Chrome (high 8.8)
- [CVE-2026-9922](https://insights.sbomify.com/CVE-2026-9922/): Use after free in Chrome (high 7.5)
- [CVE-2026-99216](https://insights.sbomify.com/CVE-2026-99216/): Drivers: hv: Don't reset VMBus connection state on error/exit paths (not scored)
- [CVE-2026-99215](https://insights.sbomify.com/CVE-2026-99215/): power: supply: core: prevent unregistering a power supply while a callback runs (not scored)
- [CVE-2026-99214](https://insights.sbomify.com/CVE-2026-99214/): drm/vc4: hdmi: Move packet RAM enable to PM runtime (not scored)
- [CVE-2026-99213](https://insights.sbomify.com/CVE-2026-99213/): vsock: treat TCP_CLOSING as once-established (not scored)
- [CVE-2026-99212](https://insights.sbomify.com/CVE-2026-99212/): net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure (not scored)
- [CVE-2026-99211](https://insights.sbomify.com/CVE-2026-99211/): netlink: reset skb headers before unicast and multicast filtering (not scored)
- [CVE-2026-99210](https://insights.sbomify.com/CVE-2026-99210/): accel/rocket: clear rdev on device init failure (not scored)
- [CVE-2026-9921](https://insights.sbomify.com/CVE-2026-9921/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-99209](https://insights.sbomify.com/CVE-2026-99209/): drm/xe: skip eviction of a BO with no resource (not scored)
- [CVE-2026-99208](https://insights.sbomify.com/CVE-2026-99208/): drm/xe/oa: Zero OA buffer at allocation (not scored)
- [CVE-2026-99207](https://insights.sbomify.com/CVE-2026-99207/): scsi: target: Disable interrupts while holding delayed_cmd_lock (not scored)
- [CVE-2026-99206](https://insights.sbomify.com/CVE-2026-99206/): scsi: target: iscsi: Fix race in discovery auth updates (not scored)
- [CVE-2026-99205](https://insights.sbomify.com/CVE-2026-99205/): sched/core: Call wakeup_preempt() for queued tasks during class change (not scored)
- [CVE-2026-99204](https://insights.sbomify.com/CVE-2026-99204/): ocfs2/dlm: Protect the recovery list during debugfs reads (not scored)
- [CVE-2026-99203](https://insights.sbomify.com/CVE-2026-99203/): pipe: preserve existing fasync readers on writer setup failure (not scored)
- [CVE-2026-99202](https://insights.sbomify.com/CVE-2026-99202/): scsi: libsas: Fix SMP IO deadlock during HA resume (not scored)
- [CVE-2026-99201](https://insights.sbomify.com/CVE-2026-99201/): netlink: avoid hashing the network namespace pointer (not scored)
- [CVE-2026-99200](https://insights.sbomify.com/CVE-2026-99200/): net: hisilicon: hisi_femac: Move setting of netops to fix crash (not scored)
- [CVE-2026-9920](https://insights.sbomify.com/CVE-2026-9920/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-99199](https://insights.sbomify.com/CVE-2026-99199/): net: hisilicon: hip04_eth: Move setting of netops to fix crash (not scored)
- [CVE-2026-99198](https://insights.sbomify.com/CVE-2026-99198/): net: ethernet: actions: Move setting of netops to fix crash (not scored)
- [CVE-2026-99197](https://insights.sbomify.com/CVE-2026-99197/): net: mv643xx: move setting of netops to fix crash (not scored)
- [CVE-2026-99196](https://insights.sbomify.com/CVE-2026-99196/): net: au1000: move setting of netops to fix crash (not scored)
- [CVE-2026-99195](https://insights.sbomify.com/CVE-2026-99195/): net: ethoc: move setting of netops to fix crash (not scored)
- [CVE-2026-99194](https://insights.sbomify.com/CVE-2026-99194/): net: ethernet: aeroflex: move setting of netops to fix crash (not scored)
- [CVE-2026-99193](https://insights.sbomify.com/CVE-2026-99193/): net: ti: icssm-prueth: Move setting of netops to fix crash (not scored)
- [CVE-2026-99192](https://insights.sbomify.com/CVE-2026-99192/): net: bcmgenet: unshare the skb before writing the control block (not scored)
- [CVE-2026-99191](https://insights.sbomify.com/CVE-2026-99191/): calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() (not scored)
- [CVE-2026-99190](https://insights.sbomify.com/CVE-2026-99190/): gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths (not scored)
- [CVE-2026-9919](https://insights.sbomify.com/CVE-2026-9919/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-99189](https://insights.sbomify.com/CVE-2026-99189/): gpio: mxc: fix race between chained IRQ handler install and probe completion (not scored)
- [CVE-2026-99188](https://insights.sbomify.com/CVE-2026-99188/): net: stmmac: dwmac1000: clear the RGMII status interrupt (not scored)
- [CVE-2026-99187](https://insights.sbomify.com/CVE-2026-99187/): perf: Fix perf_pmu_migrate_context() leaving events behind (not scored)
- [CVE-2026-99186](https://insights.sbomify.com/CVE-2026-99186/): x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() (not scored)
- [CVE-2026-99185](https://insights.sbomify.com/CVE-2026-99185/): firewire: core: fix race condition in split transaction handling (not scored)
- [CVE-2026-99184](https://insights.sbomify.com/CVE-2026-99184/): accel/rocket: search every core slot when a core is removed (not scored)
- [CVE-2026-99183](https://insights.sbomify.com/CVE-2026-99183/): accel/rocket: search every core slot when looking up a scheduler (not scored)
- [CVE-2026-99182](https://insights.sbomify.com/CVE-2026-99182/): ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture (not scored)
- [CVE-2026-99181](https://insights.sbomify.com/CVE-2026-99181/): autofs: ignore notification errors from a replaced pipe (not scored)
- [CVE-2026-99180](https://insights.sbomify.com/CVE-2026-99180/): unicode: free the map after a grace period (not scored)
- [CVE-2026-9918](https://insights.sbomify.com/CVE-2026-9918/): Privilege escalation in Chrome (critical 9.6)
- [CVE-2026-99179](https://insights.sbomify.com/CVE-2026-99179/): watch_queue: Fix note pool publication race in watch_queue_set_size() (not scored)
- [CVE-2026-99178](https://insights.sbomify.com/CVE-2026-99178/): x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (not scored)
- [CVE-2026-99177](https://insights.sbomify.com/CVE-2026-99177/): KVM: SEV: Fix page dirtying in sev_gmem_post_populate() (not scored)
- [CVE-2026-99176](https://insights.sbomify.com/CVE-2026-99176/): KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (not scored)
- [CVE-2026-99175](https://insights.sbomify.com/CVE-2026-99175/): fsnotify: prevent mark additions during connector teardown (not scored)
- [CVE-2026-99174](https://insights.sbomify.com/CVE-2026-99174/): ext4: free the sbi after a grace period (not scored)
- [CVE-2026-99173](https://insights.sbomify.com/CVE-2026-99173/): eventfs: Free the eventfs_inode after an rcu grace period too (not scored)
- [CVE-2026-99172](https://insights.sbomify.com/CVE-2026-99172/): ipc: drop the mqueue mount with kern_unmount() on setup failure (not scored)
- [CVE-2026-99171](https://insights.sbomify.com/CVE-2026-99171/): ntfs3: free the sbi after a grace period (not scored)
- [CVE-2026-99170](https://insights.sbomify.com/CVE-2026-99170/): namespace: a mount that copy_tree() leaves out can't take over a lock (not scored)
- [CVE-2026-9917](https://insights.sbomify.com/CVE-2026-9917/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-99169](https://insights.sbomify.com/CVE-2026-99169/): futex: Fix mm reuse handling for FUT_OFF_MMSHARED (not scored)
- [CVE-2026-99168](https://insights.sbomify.com/CVE-2026-99168/): mshv_vtl: Check per-CPU register page before mmap (not scored)
- [CVE-2026-99167](https://insights.sbomify.com/CVE-2026-99167/): net/sched: fix use-after-free in __tcf_action_put() (not scored)
- [CVE-2026-99166](https://insights.sbomify.com/CVE-2026-99166/): net: rds: fix uninitialized trans dereference in CM event handler (not scored)
- [CVE-2026-99165](https://insights.sbomify.com/CVE-2026-99165/): sctp: revalidate output stream after association connect wait (not scored)
- [CVE-2026-99164](https://insights.sbomify.com/CVE-2026-99164/): spi: imx: fix slab corruption from undersized DMA bounce buffers (not scored)
- [CVE-2026-99163](https://insights.sbomify.com/CVE-2026-99163/): tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields (not scored)
- [CVE-2026-99162](https://insights.sbomify.com/CVE-2026-99162/): gpio: shared: fix use-after-free bug when adding shared proxies (not scored)
- [CVE-2026-99161](https://insights.sbomify.com/CVE-2026-99161/): i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() (not scored)
- [CVE-2026-99160](https://insights.sbomify.com/CVE-2026-99160/): ring-buffer: Do not show buffer_meta for CPUs without a buffer (not scored)
- [CVE-2026-9916](https://insights.sbomify.com/CVE-2026-9916/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-99159](https://insights.sbomify.com/CVE-2026-99159/): ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() (not scored)
- [CVE-2026-99158](https://insights.sbomify.com/CVE-2026-99158/): ring-buffer: Fix false warning in ring_buffer_map_get_reader() (not scored)
- [CVE-2026-99157](https://insights.sbomify.com/CVE-2026-99157/): scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies (not scored)
- [CVE-2026-99156](https://insights.sbomify.com/CVE-2026-99156/): scsi: st: Fix use-after-free race between st_remove() and st_open() (not scored)
- [CVE-2026-99155](https://insights.sbomify.com/CVE-2026-99155/): scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (not scored)
- [CVE-2026-99154](https://insights.sbomify.com/CVE-2026-99154/): scsi: libiscsi: Reject a negative task index from parse_pdu_itt (not scored)
- [CVE-2026-99153](https://insights.sbomify.com/CVE-2026-99153/): scsi: libiscsi: Validate the ITT reflected in a Reject PDU (not scored)
- [CVE-2026-99152](https://insights.sbomify.com/CVE-2026-99152/): scsi: libiscsi: Validate the task named by a management response (not scored)
- [CVE-2026-99151](https://insights.sbomify.com/CVE-2026-99151/): drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions (not scored)
- [CVE-2026-99150](https://insights.sbomify.com/CVE-2026-99150/): drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr (not scored)
- [CVE-2026-9915](https://insights.sbomify.com/CVE-2026-9915/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-99149](https://insights.sbomify.com/CVE-2026-99149/): drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl (not scored)
- [CVE-2026-99148](https://insights.sbomify.com/CVE-2026-99148/): drm/amdgpu: keep the eviction fence until the last handle is closed (not scored)
- [CVE-2026-99147](https://insights.sbomify.com/CVE-2026-99147/): drm/exec: don't immediately add prelocked obj to array of locked objs (not scored)
- [CVE-2026-99146](https://insights.sbomify.com/CVE-2026-99146/): drm/i915/dmc: Add sanity check for DMC load address (not scored)
- [CVE-2026-99145](https://insights.sbomify.com/CVE-2026-99145/): drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change (not scored)
- [CVE-2026-99144](https://insights.sbomify.com/CVE-2026-99144/): sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue (not scored)
- [CVE-2026-99143](https://insights.sbomify.com/CVE-2026-99143/): tracing: Keep the predicate limit separate from program capacity (not scored)
- [CVE-2026-99142](https://insights.sbomify.com/CVE-2026-99142/): tracing: Check operator stack capacity before pushing (not scored)
- [CVE-2026-99141](https://insights.sbomify.com/CVE-2026-99141/): tracing: Fix crash in print_graph_function_event() (not scored)
- [CVE-2026-99140](https://insights.sbomify.com/CVE-2026-99140/): tracing: Fix hist trigger timestamps for buffered events (not scored)
- [CVE-2026-9914](https://insights.sbomify.com/CVE-2026-9914/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-99139](https://insights.sbomify.com/CVE-2026-99139/): tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (not scored)
- [CVE-2026-99138](https://insights.sbomify.com/CVE-2026-99138/): tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (not scored)
- [CVE-2026-99137](https://insights.sbomify.com/CVE-2026-99137/): cifs: don't update i_size in cifs_do_truncate without a cached handle (not scored)
- [CVE-2026-99136](https://insights.sbomify.com/CVE-2026-99136/): dm-crypt: fix a tiny race condition in crypt_dec_pending (not scored)
- [CVE-2026-99135](https://insights.sbomify.com/CVE-2026-99135/): dm-integrity: fix infinite loop on discard with large tag size (not scored)
- [CVE-2026-99134](https://insights.sbomify.com/CVE-2026-99134/): mac802154: fix data race and NULL deref on local->assoc_dev (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/200/