# Vulnerabilities published in 2026


- [CVE-2026-99042](https://insights.sbomify.com/CVE-2026-99042/): io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 (high 8.4)
- [CVE-2026-99041](https://insights.sbomify.com/CVE-2026-99041/): ip6_gre: remove obsolete ERSPAN PMTU update (not scored)
- [CVE-2026-99040](https://insights.sbomify.com/CVE-2026-99040/): KEYS: Fix add_key() race with keyring restriction (not scored)
- [CVE-2026-9904](https://insights.sbomify.com/CVE-2026-9904/): Use after free in Chrome (high 8.3)
- [CVE-2026-99039](https://insights.sbomify.com/CVE-2026-99039/): memstick: core: wait for request completion before freeing card (not scored)
- [CVE-2026-99038](https://insights.sbomify.com/CVE-2026-99038/): memstick: rtsx_usb_ms: complete requests after eject instead of dropping them (not scored)
- [CVE-2026-99037](https://insights.sbomify.com/CVE-2026-99037/): dm-crypt: reject the lmk IV mode with AEAD ciphers (not scored)
- [CVE-2026-99036](https://insights.sbomify.com/CVE-2026-99036/): dm: fix reading free memory in do_resume (not scored)
- [CVE-2026-99035](https://insights.sbomify.com/CVE-2026-99035/): mmc: mtk-sd: Cancel request timeout work on remove (not scored)
- [CVE-2026-99034](https://insights.sbomify.com/CVE-2026-99034/): mmc: sdhci-sprd: disable runtime PM on remove (not scored)
- [CVE-2026-99033](https://insights.sbomify.com/CVE-2026-99033/): net/packet: guard the ll header push in packet_rcv_spkt() (not scored)
- [CVE-2026-99032](https://insights.sbomify.com/CVE-2026-99032/): net/smc: protect clcsock lifetime in smc_getname (high 7.8)
- [CVE-2026-99031](https://insights.sbomify.com/CVE-2026-99031/): net: bridge: avoid recursive multicast port cleanup (not scored)
- [CVE-2026-99030](https://insights.sbomify.com/CVE-2026-99030/): net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() (high 7.5)
- [CVE-2026-9903](https://insights.sbomify.com/CVE-2026-9903/): Security feature bypass in Chrome (medium 5.0)
- [CVE-2026-99029](https://insights.sbomify.com/CVE-2026-99029/): net: sparx5: free the matchall entry on destroy (not scored)
- [CVE-2026-99028](https://insights.sbomify.com/CVE-2026-99028/): net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop (not scored)
- [CVE-2026-99027](https://insights.sbomify.com/CVE-2026-99027/): net: team: stop reusing skb after queue override (not scored)
- [CVE-2026-99026](https://insights.sbomify.com/CVE-2026-99026/): net: team: free skb when broadcast has no txable port (not scored)
- [CVE-2026-99025](https://insights.sbomify.com/CVE-2026-99025/): openvswitch: fix soft lockup in the netlink flow dump (not scored)
- [CVE-2026-99024](https://insights.sbomify.com/CVE-2026-99024/): optee: register TEE devices only once fully initialized (not scored)
- [CVE-2026-99023](https://insights.sbomify.com/CVE-2026-99023/): power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() (not scored)
- [CVE-2026-99022](https://insights.sbomify.com/CVE-2026-99022/): regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (not scored)
- [CVE-2026-99021](https://insights.sbomify.com/CVE-2026-99021/): regulator: of: fill in supply names in of_regulator_bulk_get_all() (not scored)
- [CVE-2026-99020](https://insights.sbomify.com/CVE-2026-99020/): regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 (not scored)
- [CVE-2026-9902](https://insights.sbomify.com/CVE-2026-9902/): Use after free in Chrome (high 8.3)
- [CVE-2026-99019](https://insights.sbomify.com/CVE-2026-99019/): scsi: ch: Do not keep references to data transfer element devices (not scored)
- [CVE-2026-99018](https://insights.sbomify.com/CVE-2026-99018/): riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp (high 7.8)
- [CVE-2026-99017](https://insights.sbomify.com/CVE-2026-99017/): riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE (high 7.0)
- [CVE-2026-99016](https://insights.sbomify.com/CVE-2026-99016/): riscv: futex: untag the user pointer before the atomic access (high 7.8)
- [CVE-2026-99015](https://insights.sbomify.com/CVE-2026-99015/): Bluetooth: hci_sock: Serialize dead-device detachment (not scored)
- [CVE-2026-99014](https://insights.sbomify.com/CVE-2026-99014/): Bluetooth: hci_sync: Fix command skb lifetime during scan setup (high 7.8)
- [CVE-2026-99013](https://insights.sbomify.com/CVE-2026-99013/): Bluetooth: ISO: Reject concurrent BIS listener setup (high 7.8)
- [CVE-2026-99012](https://insights.sbomify.com/CVE-2026-99012/): Bluetooth: ISO: Serialize concurrent connect calls (high 7.8)
- [CVE-2026-99011](https://insights.sbomify.com/CVE-2026-99011/): Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() (high 7.1)
- [CVE-2026-99010](https://insights.sbomify.com/CVE-2026-99010/): Bluetooth: RFCOMM: free the skb when the DLC has no owner (not scored)
- [CVE-2026-9901](https://insights.sbomify.com/CVE-2026-9901/): Use after free in Chrome (high 7.5)
- [CVE-2026-99009](https://insights.sbomify.com/CVE-2026-99009/): Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex (not scored)
- [CVE-2026-99008](https://insights.sbomify.com/CVE-2026-99008/): Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown (not scored)
- [CVE-2026-99007](https://insights.sbomify.com/CVE-2026-99007/): drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN (not scored)
- [CVE-2026-99006](https://insights.sbomify.com/CVE-2026-99006/): drm/i915/gem: Prevent overstepping exec array boundary (high 7.8)
- [CVE-2026-99005](https://insights.sbomify.com/CVE-2026-99005/): drm/i915/gt: Unmask interrupts only when ACTIVE is true (not scored)
- [CVE-2026-99004](https://insights.sbomify.com/CVE-2026-99004/): drm/imagination: Size page table preallocation by device address (not scored)
- [CVE-2026-99003](https://insights.sbomify.com/CVE-2026-99003/): drm/panthor: validate userspace queue count against initialized firmware slot count (not scored)
- [CVE-2026-99002](https://insights.sbomify.com/CVE-2026-99002/): drm/vmwgfx: validate pitch coming from userspace (high 7.8)
- [CVE-2026-99001](https://insights.sbomify.com/CVE-2026-99001/): drm/xe/i2c: cancel the client work on remove (not scored)
- [CVE-2026-99000](https://insights.sbomify.com/CVE-2026-99000/): drm/xe: Fix shrinker accounting double-subtraction on nested external pins (not scored)
- [CVE-2026-9900](https://insights.sbomify.com/CVE-2026-9900/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-98999](https://insights.sbomify.com/CVE-2026-98999/): drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin (high 7.8)
- [CVE-2026-98998](https://insights.sbomify.com/CVE-2026-98998/): drm/bridge: th1520-dw-hdmi: Fix remove() callback (not scored)
- [CVE-2026-98997](https://insights.sbomify.com/CVE-2026-98997/): drm/amdgpu/userq: only accept doorbell BOs as queue doorbell (not scored)
- [CVE-2026-98996](https://insights.sbomify.com/CVE-2026-98996/): fs: don't silently unmount busy mounts (not scored)
- [CVE-2026-98995](https://insights.sbomify.com/CVE-2026-98995/): namespace: reset the old parent's ->overmount in mnt_change_mountpoint() (high 7.8)
- [CVE-2026-98994](https://insights.sbomify.com/CVE-2026-98994/): statmount: read the parent of an unmounted mount under mount_lock (not scored)
- [CVE-2026-98993](https://insights.sbomify.com/CVE-2026-98993/): namespace: don't inherit MNT_UMOUNT in clone_mnt() (high 7.8)
- [CVE-2026-98992](https://insights.sbomify.com/CVE-2026-98992/): namespace: don't copy an unmounted mount tree (not scored)
- [CVE-2026-98991](https://insights.sbomify.com/CVE-2026-98991/): namespace: queue a mount only once for mount notifications (high 7.8)
- [CVE-2026-98990](https://insights.sbomify.com/CVE-2026-98990/): namespace: check a submount for references right before unmounting it (not scored)
- [CVE-2026-9899](https://insights.sbomify.com/CVE-2026-9899/): Use after free in Chrome (high 8.3)
- [CVE-2026-98989](https://insights.sbomify.com/CVE-2026-98989/): namespace: check a recursive bind mount for mount namespace loops (not scored)
- [CVE-2026-98988](https://insights.sbomify.com/CVE-2026-98988/): namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE (high 8.8)
- [CVE-2026-98987](https://insights.sbomify.com/CVE-2026-98987/): namespace: look at the topmost mount for a mount namespace file (not scored)
- [CVE-2026-98986](https://insights.sbomify.com/CVE-2026-98986/): namespace: remove the fsnotify marks of a mount namespace in process context (not scored)
- [CVE-2026-98985](https://insights.sbomify.com/CVE-2026-98985/): namespace: check the mounts before reading their parents in pivot_root() (not scored)
- [CVE-2026-98984](https://insights.sbomify.com/CVE-2026-98984/): dcache: don't put a mountpoint on a dentry that's being removed (not scored)
- [CVE-2026-98983](https://insights.sbomify.com/CVE-2026-98983/): unshare: don't drop active namespace references that were never taken (not scored)
- [CVE-2026-98982](https://insights.sbomify.com/CVE-2026-98982/): namespace: don't let a pseudo dentry become the root of a mount (high 7.8)
- [CVE-2026-98981](https://insights.sbomify.com/CVE-2026-98981/): namespace: unhash a dentry before detaching the mounts on it (high 8.8)
- [CVE-2026-98980](https://insights.sbomify.com/CVE-2026-98980/): namei: don't reveal overmounted entries in refwalk (high 8.8)
- [CVE-2026-9898](https://insights.sbomify.com/CVE-2026-9898/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-98979](https://insights.sbomify.com/CVE-2026-98979/): namespace: refuse an automount below a mount that is in no namespace (not scored)
- [CVE-2026-98978](https://insights.sbomify.com/CVE-2026-98978/): namespace: never expire a locked mount (high 8.4)
- [CVE-2026-98977](https://insights.sbomify.com/CVE-2026-98977/): namespace: handle mount locking for automounts correctly (not scored)
- [CVE-2026-98976](https://insights.sbomify.com/CVE-2026-98976/): namespace: keep the lock on a mount that a propagated copy is moved beneath (high 7.8)
- [CVE-2026-98975](https://insights.sbomify.com/CVE-2026-98975/): xfs: stop exchanging reflink flags when exchanging mappings (high 7.8)
- [CVE-2026-98974](https://insights.sbomify.com/CVE-2026-98974/): xfs: fix exchange-range-to-eof file size exchange (high 7.8)
- [CVE-2026-98973](https://insights.sbomify.com/CVE-2026-98973/): drm/bridge: Fix unlocked list_del in drm_bridge_add() (not scored)
- [CVE-2026-98972](https://insights.sbomify.com/CVE-2026-98972/): cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() (not scored)
- [CVE-2026-98971](https://insights.sbomify.com/CVE-2026-98971/): gpio: exar: initialize the ID before registering its cleanup (not scored)
- [CVE-2026-98970](https://insights.sbomify.com/CVE-2026-98970/): drm/vc4: Free the BO cache size list on teardown (not scored)
- [CVE-2026-9897](https://insights.sbomify.com/CVE-2026-9897/): Use after free in Chrome (high 8.8)
- [CVE-2026-98969](https://insights.sbomify.com/CVE-2026-98969/): net/sched: em_text: reject unterminated algo before autoload (not scored)
- [CVE-2026-98968](https://insights.sbomify.com/CVE-2026-98968/): amt: send the relay's General Query directly from the receive path (high 8.1)
- [CVE-2026-98967](https://insights.sbomify.com/CVE-2026-98967/): cxgb4/ch_ktls: disable softirqs around tid_list erases (not scored)
- [CVE-2026-98966](https://insights.sbomify.com/CVE-2026-98966/): bonding: fix the program leak when XDP is replaced (not scored)
- [CVE-2026-98965](https://insights.sbomify.com/CVE-2026-98965/): ice: Restore Ordered MMIO Writes for Tx Doorbells (high 7.5)
- [CVE-2026-98964](https://insights.sbomify.com/CVE-2026-98964/): nvmet: use the local P2P device on metadata allocation failure (high 7.5)
- [CVE-2026-98963](https://insights.sbomify.com/CVE-2026-98963/): btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio (not scored)
- [CVE-2026-98962](https://insights.sbomify.com/CVE-2026-98962/): btrfs: free iov when btrfs_uring_read_extent() fails (not scored)
- [CVE-2026-98961](https://insights.sbomify.com/CVE-2026-98961/): btrfs: unlock inode and extent in caller when io_uring read extent fails (not scored)
- [CVE-2026-98960](https://insights.sbomify.com/CVE-2026-98960/): btrfs: don't stash io_uring encoded data across -EAGAIN (not scored)
- [CVE-2026-9896](https://insights.sbomify.com/CVE-2026-9896/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-98959](https://insights.sbomify.com/CVE-2026-98959/): btrfs: fix xattr replace when multiple xattrs are packed in the same item (critical 9.8)
- [CVE-2026-98958](https://insights.sbomify.com/CVE-2026-98958/): wifi: mt76: account non-AQL frames per peer rather than per link (not scored)
- [CVE-2026-98957](https://insights.sbomify.com/CVE-2026-98957/): wifi: mt76: mt7915: disable rx napi when removing device (not scored)
- [CVE-2026-98956](https://insights.sbomify.com/CVE-2026-98956/): ASoC: adau1372: allow sleepy powerdown GPIOs (not scored)
- [CVE-2026-98955](https://insights.sbomify.com/CVE-2026-98955/): flow_dissector: avoid u16 truncation of skb->len when computing thoff (not scored)
- [CVE-2026-98954](https://insights.sbomify.com/CVE-2026-98954/): net: always dissect GSO packets in __virtio_net_hdr_to_skb() (not scored)
- [CVE-2026-98953](https://insights.sbomify.com/CVE-2026-98953/): devlink: fix devlink_rel reference leak when notify work is pending (not scored)
- [CVE-2026-98952](https://insights.sbomify.com/CVE-2026-98952/): pfcp: make sure the SEID is linear before reading it (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/202/