Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 202 of 1013.
- CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
- CVE-2026-99041 ip6_gre: remove obsolete ERSPAN PMTU update
- CVE-2026-99040 KEYS: Fix add_key() race with keyring restriction
- CVE-2026-9904 Use after free in Chrome
- CVE-2026-99039 memstick: core: wait for request completion before freeing card
- CVE-2026-99038 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
- CVE-2026-99037 dm-crypt: reject the lmk IV mode with AEAD ciphers
- CVE-2026-99036 dm: fix reading free memory in do_resume
- CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove
- CVE-2026-99034 mmc: sdhci-sprd: disable runtime PM on remove
- CVE-2026-99033 net/packet: guard the ll header push in packet_rcv_spkt()
- CVE-2026-99032 net/smc: protect clcsock lifetime in smc_getname
- CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup
- CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
- CVE-2026-9903 Security feature bypass in Chrome
- CVE-2026-99029 net: sparx5: free the matchall entry on destroy
- CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- CVE-2026-99027 net: team: stop reusing skb after queue override
- CVE-2026-99026 net: team: free skb when broadcast has no txable port
- CVE-2026-99025 openvswitch: fix soft lockup in the netlink flow dump
- CVE-2026-99024 optee: register TEE devices only once fully initialized
- CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
- CVE-2026-99022 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
- CVE-2026-99021 regulator: of: fill in supply names in of_regulator_bulk_get_all()
- CVE-2026-99020 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
- CVE-2026-9902 Use after free in Chrome
- CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices
- CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
- CVE-2026-99017 riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
- CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access
- CVE-2026-99015 Bluetooth: hci_sock: Serialize dead-device detachment
- CVE-2026-99014 Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- CVE-2026-99013 Bluetooth: ISO: Reject concurrent BIS listener setup
- CVE-2026-99012 Bluetooth: ISO: Serialize concurrent connect calls
- CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
- CVE-2026-99010 Bluetooth: RFCOMM: free the skb when the DLC has no owner
- CVE-2026-9901 Use after free in Chrome
- CVE-2026-99009 Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- CVE-2026-99008 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- CVE-2026-99007 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- CVE-2026-99006 drm/i915/gem: Prevent overstepping exec array boundary
- CVE-2026-99005 drm/i915/gt: Unmask interrupts only when ACTIVE is true
- CVE-2026-99004 drm/imagination: Size page table preallocation by device address
- CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count
- CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace
- CVE-2026-99001 drm/xe/i2c: cancel the client work on remove
- CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins
- CVE-2026-9900 Memory corruption in Chrome
- CVE-2026-98999 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
- CVE-2026-98998 drm/bridge: th1520-dw-hdmi: Fix remove() callback
- CVE-2026-98997 drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
- CVE-2026-98996 fs: don't silently unmount busy mounts
- CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
- CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock
- CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt()
- CVE-2026-98992 namespace: don't copy an unmounted mount tree
- CVE-2026-98991 namespace: queue a mount only once for mount notifications
- CVE-2026-98990 namespace: check a submount for references right before unmounting it
- CVE-2026-9899 Use after free in Chrome
- CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops
- CVE-2026-98988 namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
- CVE-2026-98987 namespace: look at the topmost mount for a mount namespace file
- CVE-2026-98986 namespace: remove the fsnotify marks of a mount namespace in process context
- CVE-2026-98985 namespace: check the mounts before reading their parents in pivot_root()
- CVE-2026-98984 dcache: don't put a mountpoint on a dentry that's being removed
- CVE-2026-98983 unshare: don't drop active namespace references that were never taken
- CVE-2026-98982 namespace: don't let a pseudo dentry become the root of a mount
- CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it
- CVE-2026-98980 namei: don't reveal overmounted entries in refwalk
- CVE-2026-9898 Security feature bypass in Chrome
- CVE-2026-98979 namespace: refuse an automount below a mount that is in no namespace
- CVE-2026-98978 namespace: never expire a locked mount
- CVE-2026-98977 namespace: handle mount locking for automounts correctly
- CVE-2026-98976 namespace: keep the lock on a mount that a propagated copy is moved beneath
- CVE-2026-98975 xfs: stop exchanging reflink flags when exchanging mappings
- CVE-2026-98974 xfs: fix exchange-range-to-eof file size exchange
- CVE-2026-98973 drm/bridge: Fix unlocked list_del in drm_bridge_add()
- CVE-2026-98972 cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- CVE-2026-98971 gpio: exar: initialize the ID before registering its cleanup
- CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown
- CVE-2026-9897 Use after free in Chrome
- CVE-2026-98969 net/sched: em_text: reject unterminated algo before autoload
- CVE-2026-98968 amt: send the relay's General Query directly from the receive path
- CVE-2026-98967 cxgb4/ch_ktls: disable softirqs around tid_list erases
- CVE-2026-98966 bonding: fix the program leak when XDP is replaced
- CVE-2026-98965 ice: Restore Ordered MMIO Writes for Tx Doorbells
- CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure
- CVE-2026-98963 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
- CVE-2026-98962 btrfs: free iov when btrfs_uring_read_extent() fails
- CVE-2026-98961 btrfs: unlock inode and extent in caller when io_uring read extent fails
- CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN
- CVE-2026-9896 Memory corruption in Chrome
- CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item
- CVE-2026-98958 wifi: mt76: account non-AQL frames per peer rather than per link
- CVE-2026-98957 wifi: mt76: mt7915: disable rx napi when removing device
- CVE-2026-98956 ASoC: adau1372: allow sleepy powerdown GPIOs
- CVE-2026-98955 flow_dissector: avoid u16 truncation of skb->len when computing thoff
- CVE-2026-98954 net: always dissect GSO packets in __virtio_net_hdr_to_skb()
- CVE-2026-98953 devlink: fix devlink_rel reference leak when notify work is pending
- CVE-2026-98952 pfcp: make sure the SEID is linear before reading it