Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 201 of 1013.
- CVE-2026-99133 net/iucv: fix the recvmsg window update
- CVE-2026-99132 xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
- CVE-2026-99131 xfs: fix capability check in xfs
- CVE-2026-99130 io_uring/cancel: don't spin on local work the task can't run
- CVE-2026-9913 Memory corruption in Chrome
- CVE-2026-99129 selinux: fix BPF token permission checks
- CVE-2026-99128 sctp: validate chunk length in the inqueue parser
- CVE-2026-99127 page_pool: keep frag_offset aligned for odd-sized requests
- CVE-2026-99126 s390/ctcm: Prevent XID null dereference
- CVE-2026-99125 s390/pai: Handle multiple PMU stop callback invocations
- CVE-2026-99124 s390/pci: Fix leak of uninitialized kernel data in SCLP report
- CVE-2026-99123 vsock/virtio: validate packet source for connected sockets
- CVE-2026-99122 vsock/vmci: validate packet source for connected sockets
- CVE-2026-99121 ipv4: avoid divide by zero in fib_rebalance
- CVE-2026-99120 KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
- CVE-2026-9912 Information disclosure in Chrome
- CVE-2026-99119 drm/amdgpu/userq: actually validate userq BOs
- CVE-2026-99118 drm/i915/dmc: Harden DMC firmware payload parsing
- CVE-2026-99117 net: bridge: mcast: don't truncate the port group walk on teardown
- CVE-2026-99116 net: psp: do not inherit the Rx association on clone
- CVE-2026-99115 ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
- CVE-2026-99114 ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
- CVE-2026-99113 ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
- CVE-2026-99112 net/sched: cls_flower: validate mask pointer after nla_next()
- CVE-2026-99111 smb: client: fix data corruption with concurrent writes and O_TRUNC
- CVE-2026-99110 smb: client: fix heap overflow in cifs_do_set_acl()
- CVE-2026-9911 Integer overflow in Chrome
- CVE-2026-99109 smb: client: reject SetEA requests that do not fit the request buffer
- CVE-2026-99108 ntfs: fix FITRIM range alignment
- CVE-2026-99107 ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
- CVE-2026-99106 drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
- CVE-2026-99105 sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
- CVE-2026-99104 sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
- CVE-2026-99103 workqueue: Fix unbound pool lifetime for pending pwqs
- CVE-2026-99102 ntfs: take invalidate_lock in ntfs_setattr_size()
- CVE-2026-99101 ntfs: move attribute payload before shrinking its record
- CVE-2026-99100 wifi: p54: validate firmware record lengths
- CVE-2026-9910 Memory corruption in Chrome
- CVE-2026-99099 x86/CPU/AMD: Fix AMD TLBI Erratum #1718
- CVE-2026-99098 dm-integrity: fix buffer overflow in inline mode with large tag size
- CVE-2026-99097 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
- CVE-2026-99096 io_uring/register: don't exempt disabled rings from task restrictions
- CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind
- CVE-2026-99094 Bluetooth: btintel_pcie: fix TX descriptor bounds check
- CVE-2026-99093 mm: don't schedule deferred kernel page table freeing while booting
- CVE-2026-99092 riscv: patch: fix handling of bpf-jit execmem addresses
- CVE-2026-99091 Bluetooth: MGMT: Fix status of pending commands flushed on power off
- CVE-2026-99090 drm/amdgpu: serialize vblank counter reads against GPU reset
- CVE-2026-9909 Integer overflow in Chrome
- CVE-2026-99089 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
- CVE-2026-99088 net: openvswitch: validate transport header presence in set_ipv6_addr
- CVE-2026-99087 dm-integrity: fix NULL pointer dereference when the 'R' flag is used
- CVE-2026-99086 dm-integrity: validate the superblock on resume
- CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
- CVE-2026-99084 readdir: take no inode lock on an immutable directory
- CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()
- CVE-2026-99082 KVM: x86: Use active memslots for the per-vCPU MMIO cache
- CVE-2026-99081 bnxt_en: fix DMA mapping length for padded small packets
- CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode()
- CVE-2026-9908 Memory corruption in Chrome
- CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry
- CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
- CVE-2026-99077 ipv4: udp: Create exceptions before socket matching
- CVE-2026-99076 ipv6: udp: Create exceptions before socket matching
- CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit
- CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks
- CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks
- CVE-2026-99072 ipv4: stop route notification sizing when nexthop group shrinks
- CVE-2026-99071 ipv4: do not warn on route notification size race
- CVE-2026-99070 ipv6: do not warn on route notification size race
- CVE-2026-9907 Memory corruption in Chrome
- CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers
- CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
- CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
- CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization
- CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
- CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO
- CVE-2026-99063 dm ioctl: don't let data_start run past the buffer
- CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()
- CVE-2026-99061 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
- CVE-2026-99060 wifi: mt76: mt7603: initialize global station WCID
- CVE-2026-9906 Memory corruption in Chrome
- CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation
- CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check
- CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails
- CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser
- CVE-2026-99055 tcp: reject net_iov in zerocopy receive mapping hints
- CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections
- CVE-2026-99053 tipc: hold a reference to nodes found by link name
- CVE-2026-99052 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
- CVE-2026-99051 fsverity: RCU-delay the freeing of struct fsverity_info
- CVE-2026-99050 gpio: mpsse: fix race when arming the IRQ poll worker
- CVE-2026-9905 Use after free in Chrome
- CVE-2026-99049 gpio: xilinx: fix runtime PM leak on request error path
- CVE-2026-99048 gve: fix napi_disable deadlock when attempting to disable XSK pools
- CVE-2026-99047 gve: fix XSK buffer leak when rings are stopped
- CVE-2026-99046 gve: fix XSK buffer leak on error descriptor
- CVE-2026-99045 ibmveth: h_free logical LAN on open-fail after register
- CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup
- CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown