# Vulnerabilities published in 2026


- [CVE-2026-99133](https://insights.sbomify.com/CVE-2026-99133/): net/iucv: fix the recvmsg window update (not scored)
- [CVE-2026-99132](https://insights.sbomify.com/CVE-2026-99132/): xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf (not scored)
- [CVE-2026-99131](https://insights.sbomify.com/CVE-2026-99131/): xfs: fix capability check in xfs (not scored)
- [CVE-2026-99130](https://insights.sbomify.com/CVE-2026-99130/): io_uring/cancel: don't spin on local work the task can't run (not scored)
- [CVE-2026-9913](https://insights.sbomify.com/CVE-2026-9913/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-99129](https://insights.sbomify.com/CVE-2026-99129/): selinux: fix BPF token permission checks (not scored)
- [CVE-2026-99128](https://insights.sbomify.com/CVE-2026-99128/): sctp: validate chunk length in the inqueue parser (not scored)
- [CVE-2026-99127](https://insights.sbomify.com/CVE-2026-99127/): page_pool: keep frag_offset aligned for odd-sized requests (not scored)
- [CVE-2026-99126](https://insights.sbomify.com/CVE-2026-99126/): s390/ctcm: Prevent XID null dereference (not scored)
- [CVE-2026-99125](https://insights.sbomify.com/CVE-2026-99125/): s390/pai: Handle multiple PMU stop callback invocations (not scored)
- [CVE-2026-99124](https://insights.sbomify.com/CVE-2026-99124/): s390/pci: Fix leak of uninitialized kernel data in SCLP report (not scored)
- [CVE-2026-99123](https://insights.sbomify.com/CVE-2026-99123/): vsock/virtio: validate packet source for connected sockets (not scored)
- [CVE-2026-99122](https://insights.sbomify.com/CVE-2026-99122/): vsock/vmci: validate packet source for connected sockets (not scored)
- [CVE-2026-99121](https://insights.sbomify.com/CVE-2026-99121/): ipv4: avoid divide by zero in fib_rebalance (not scored)
- [CVE-2026-99120](https://insights.sbomify.com/CVE-2026-99120/): KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes (not scored)
- [CVE-2026-9912](https://insights.sbomify.com/CVE-2026-9912/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-99119](https://insights.sbomify.com/CVE-2026-99119/): drm/amdgpu/userq: actually validate userq BOs (not scored)
- [CVE-2026-99118](https://insights.sbomify.com/CVE-2026-99118/): drm/i915/dmc: Harden DMC firmware payload parsing (not scored)
- [CVE-2026-99117](https://insights.sbomify.com/CVE-2026-99117/): net: bridge: mcast: don't truncate the port group walk on teardown (not scored)
- [CVE-2026-99116](https://insights.sbomify.com/CVE-2026-99116/): net: psp: do not inherit the Rx association on clone (not scored)
- [CVE-2026-99115](https://insights.sbomify.com/CVE-2026-99115/): ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION (not scored)
- [CVE-2026-99114](https://insights.sbomify.com/CVE-2026-99114/): ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION (not scored)
- [CVE-2026-99113](https://insights.sbomify.com/CVE-2026-99113/): ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in (not scored)
- [CVE-2026-99112](https://insights.sbomify.com/CVE-2026-99112/): net/sched: cls_flower: validate mask pointer after nla_next() (not scored)
- [CVE-2026-99111](https://insights.sbomify.com/CVE-2026-99111/): smb: client: fix data corruption with concurrent writes and O_TRUNC (not scored)
- [CVE-2026-99110](https://insights.sbomify.com/CVE-2026-99110/): smb: client: fix heap overflow in cifs_do_set_acl() (not scored)
- [CVE-2026-9911](https://insights.sbomify.com/CVE-2026-9911/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-99109](https://insights.sbomify.com/CVE-2026-99109/): smb: client: reject SetEA requests that do not fit the request buffer (not scored)
- [CVE-2026-99108](https://insights.sbomify.com/CVE-2026-99108/): ntfs: fix FITRIM range alignment (not scored)
- [CVE-2026-99107](https://insights.sbomify.com/CVE-2026-99107/): ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize (not scored)
- [CVE-2026-99106](https://insights.sbomify.com/CVE-2026-99106/): drm/amdgpu: free the userptr ranges when a CS fails after parser_bos (not scored)
- [CVE-2026-99105](https://insights.sbomify.com/CVE-2026-99105/): sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ (not scored)
- [CVE-2026-99104](https://insights.sbomify.com/CVE-2026-99104/): sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor (not scored)
- [CVE-2026-99103](https://insights.sbomify.com/CVE-2026-99103/): workqueue: Fix unbound pool lifetime for pending pwqs (not scored)
- [CVE-2026-99102](https://insights.sbomify.com/CVE-2026-99102/): ntfs: take invalidate_lock in ntfs_setattr_size() (not scored)
- [CVE-2026-99101](https://insights.sbomify.com/CVE-2026-99101/): ntfs: move attribute payload before shrinking its record (not scored)
- [CVE-2026-99100](https://insights.sbomify.com/CVE-2026-99100/): wifi: p54: validate firmware record lengths (not scored)
- [CVE-2026-9910](https://insights.sbomify.com/CVE-2026-9910/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-99099](https://insights.sbomify.com/CVE-2026-99099/): x86/CPU/AMD: Fix AMD TLBI Erratum #1718 (not scored)
- [CVE-2026-99098](https://insights.sbomify.com/CVE-2026-99098/): dm-integrity: fix buffer overflow in inline mode with large tag size (not scored)
- [CVE-2026-99097](https://insights.sbomify.com/CVE-2026-99097/): tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() (not scored)
- [CVE-2026-99096](https://insights.sbomify.com/CVE-2026-99096/): io_uring/register: don't exempt disabled rings from task restrictions (not scored)
- [CVE-2026-99095](https://insights.sbomify.com/CVE-2026-99095/): drm/vc4: drain the hangcheck timer and works on V3D unbind (not scored)
- [CVE-2026-99094](https://insights.sbomify.com/CVE-2026-99094/): Bluetooth: btintel_pcie: fix TX descriptor bounds check (not scored)
- [CVE-2026-99093](https://insights.sbomify.com/CVE-2026-99093/): mm: don't schedule deferred kernel page table freeing while booting (not scored)
- [CVE-2026-99092](https://insights.sbomify.com/CVE-2026-99092/): riscv: patch: fix handling of bpf-jit execmem addresses (not scored)
- [CVE-2026-99091](https://insights.sbomify.com/CVE-2026-99091/): Bluetooth: MGMT: Fix status of pending commands flushed on power off (not scored)
- [CVE-2026-99090](https://insights.sbomify.com/CVE-2026-99090/): drm/amdgpu: serialize vblank counter reads against GPU reset (not scored)
- [CVE-2026-9909](https://insights.sbomify.com/CVE-2026-9909/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-99089](https://insights.sbomify.com/CVE-2026-99089/): ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM (not scored)
- [CVE-2026-99088](https://insights.sbomify.com/CVE-2026-99088/): net: openvswitch: validate transport header presence in set_ipv6_addr (not scored)
- [CVE-2026-99087](https://insights.sbomify.com/CVE-2026-99087/): dm-integrity: fix NULL pointer dereference when the 'R' flag is used (not scored)
- [CVE-2026-99086](https://insights.sbomify.com/CVE-2026-99086/): dm-integrity: validate the superblock on resume (not scored)
- [CVE-2026-99085](https://insights.sbomify.com/CVE-2026-99085/): sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler (not scored)
- [CVE-2026-99084](https://insights.sbomify.com/CVE-2026-99084/): readdir: take no inode lock on an immutable directory (not scored)
- [CVE-2026-99083](https://insights.sbomify.com/CVE-2026-99083/): ksmbd: fix heap out-of-bounds write in krb5_authenticate() (high 8.8)
- [CVE-2026-99082](https://insights.sbomify.com/CVE-2026-99082/): KVM: x86: Use active memslots for the per-vCPU MMIO cache (high 8.8)
- [CVE-2026-99081](https://insights.sbomify.com/CVE-2026-99081/): bnxt_en: fix DMA mapping length for padded small packets (high 7.5)
- [CVE-2026-99080](https://insights.sbomify.com/CVE-2026-99080/): fs: Free any excess xarray nodes in clear_inode() (not scored)
- [CVE-2026-9908](https://insights.sbomify.com/CVE-2026-9908/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-99079](https://insights.sbomify.com/CVE-2026-99079/): net/mlx5e: Prevent stale XSK buffer release on refill retry (critical 9.8)
- [CVE-2026-99078](https://insights.sbomify.com/CVE-2026-99078/): net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry (critical 9.8)
- [CVE-2026-99077](https://insights.sbomify.com/CVE-2026-99077/): ipv4: udp: Create exceptions before socket matching (high 7.4)
- [CVE-2026-99076](https://insights.sbomify.com/CVE-2026-99076/): ipv6: udp: Create exceptions before socket matching (not scored)
- [CVE-2026-99075](https://insights.sbomify.com/CVE-2026-99075/): rust_binder: reschedule node refcount update on thread exit (not scored)
- [CVE-2026-99074](https://insights.sbomify.com/CVE-2026-99074/): ipv4: stop PMTU walk when nexthop group shrinks (not scored)
- [CVE-2026-99073](https://insights.sbomify.com/CVE-2026-99073/): ipv4: stop exception dump when nexthop group shrinks (not scored)
- [CVE-2026-99072](https://insights.sbomify.com/CVE-2026-99072/): ipv4: stop route notification sizing when nexthop group shrinks (not scored)
- [CVE-2026-99071](https://insights.sbomify.com/CVE-2026-99071/): ipv4: do not warn on route notification size race (not scored)
- [CVE-2026-99070](https://insights.sbomify.com/CVE-2026-99070/): ipv6: do not warn on route notification size race (not scored)
- [CVE-2026-9907](https://insights.sbomify.com/CVE-2026-9907/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-99069](https://insights.sbomify.com/CVE-2026-99069/): Input: ati_remote2 - fix type confusion in device attribute handlers (not scored)
- [CVE-2026-99068](https://insights.sbomify.com/CVE-2026-99068/): ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers (not scored)
- [CVE-2026-99067](https://insights.sbomify.com/CVE-2026-99067/): btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() (not scored)
- [CVE-2026-99066](https://insights.sbomify.com/CVE-2026-99066/): can: dev: init_can_skb(): restore skb header initialization (not scored)
- [CVE-2026-99065](https://insights.sbomify.com/CVE-2026-99065/): cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() (not scored)
- [CVE-2026-99064](https://insights.sbomify.com/CVE-2026-99064/): cipso: adjust cached option offsets when removing CIPSO (high 8.1)
- [CVE-2026-99063](https://insights.sbomify.com/CVE-2026-99063/): dm ioctl: don't let data_start run past the buffer (not scored)
- [CVE-2026-99062](https://insights.sbomify.com/CVE-2026-99062/): vsock/virtio: account only unread bytes in read_skb() (not scored)
- [CVE-2026-99061](https://insights.sbomify.com/CVE-2026-99061/): wifi: brcmfmac: fix P2P device removal race in brcmf_detach() (not scored)
- [CVE-2026-99060](https://insights.sbomify.com/CVE-2026-99060/): wifi: mt76: mt7603: initialize global station WCID (not scored)
- [CVE-2026-9906](https://insights.sbomify.com/CVE-2026-9906/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-99059](https://insights.sbomify.com/CVE-2026-99059/): wireguard: noise: reject response consumption after intermediate initiation (high 7.7)
- [CVE-2026-99058](https://insights.sbomify.com/CVE-2026-99058/): workqueue: Fix NULL current_pwq deref in chained work check (not scored)
- [CVE-2026-99057](https://insights.sbomify.com/CVE-2026-99057/): xen/netfront: don't leak the skb when xennet_fill_frags() fails (not scored)
- [CVE-2026-99056](https://insights.sbomify.com/CVE-2026-99056/): strparser: make sure __strp_recv isn't running before tearing down the parser (high 7.8)
- [CVE-2026-99055](https://insights.sbomify.com/CVE-2026-99055/): tcp: reject net_iov in zerocopy receive mapping hints (not scored)
- [CVE-2026-99054](https://insights.sbomify.com/CVE-2026-99054/): tipc: destroy topsrv workqueues before closing connections (high 7.8)
- [CVE-2026-99053](https://insights.sbomify.com/CVE-2026-99053/): tipc: hold a reference to nodes found by link name (high 7.8)
- [CVE-2026-99052](https://insights.sbomify.com/CVE-2026-99052/): selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts (not scored)
- [CVE-2026-99051](https://insights.sbomify.com/CVE-2026-99051/): fsverity: RCU-delay the freeing of struct fsverity_info (high 7.8)
- [CVE-2026-99050](https://insights.sbomify.com/CVE-2026-99050/): gpio: mpsse: fix race when arming the IRQ poll worker (high 7.8)
- [CVE-2026-9905](https://insights.sbomify.com/CVE-2026-9905/): Use after free in Chrome (high 8.3)
- [CVE-2026-99049](https://insights.sbomify.com/CVE-2026-99049/): gpio: xilinx: fix runtime PM leak on request error path (not scored)
- [CVE-2026-99048](https://insights.sbomify.com/CVE-2026-99048/): gve: fix napi_disable deadlock when attempting to disable XSK pools (not scored)
- [CVE-2026-99047](https://insights.sbomify.com/CVE-2026-99047/): gve: fix XSK buffer leak when rings are stopped (not scored)
- [CVE-2026-99046](https://insights.sbomify.com/CVE-2026-99046/): gve: fix XSK buffer leak on error descriptor (high 7.5)
- [CVE-2026-99045](https://insights.sbomify.com/CVE-2026-99045/): ibmveth: h_free logical LAN on open-fail after register (not scored)
- [CVE-2026-99044](https://insights.sbomify.com/CVE-2026-99044/): ice: fix use-after-free in dynamic port cleanup (not scored)
- [CVE-2026-99043](https://insights.sbomify.com/CVE-2026-99043/): ice: fix metadata_dst refcount handling on representor teardown (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/201/