Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 203 of 1013.
- CVE-2026-98951 riscv: ptrace: Zero-initialize regset buffers before copyin
- CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
- CVE-2026-9895 Memory corruption in Chrome
- CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()
- CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
- CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
- CVE-2026-98946 drm/vc4: Disable the V3D interrupt across runtime suspend
- CVE-2026-98945 HID: steam: Rearrange teardown sequence
- CVE-2026-98944 HID: steam: Refactor registration
- CVE-2026-98942 sched_ext: Build the cid tables privately and publish them with RCU
- CVE-2026-98941 ext4: don't enable large folios on encrypted inodes
- CVE-2026-98940 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
- CVE-2026-9894 Use after free in Chrome
- CVE-2026-98939 x86/mm: Drop unnecessary PMD page copy when freeing
- CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq
- CVE-2026-98937 perf/core: Check kernel access when kernel callchains are requested
- CVE-2026-98936 wifi: ath11k: reset ar->num_stations on hardware start
- CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
- CVE-2026-98934 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
- CVE-2026-98933 usb: hub: use shorter 120ms post resume hold for SS root hubs
- CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths
- CVE-2026-98931 mtd: spinand: fix NULL pointer dereference with no ECC engine
- CVE-2026-98930 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
- CVE-2026-9893 Use after free in Chrome
- CVE-2026-98929 macsec: initialize SecY before registering the netdevice
- CVE-2026-98928 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
- CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array
- CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS
- CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting
- CVE-2026-98924 fs: avoid repeated scans in evict_inodes()
- CVE-2026-98923 arm64: io: Reject non-user protection in ioremap_prot()
- CVE-2026-98922 net: emac: move setting of netops to fix crash
- CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print
- CVE-2026-98920 netfs: Fix missing alloc tagging of direct mempool allocations
- CVE-2026-9892 Privilege escalation in Chrome
- CVE-2026-98919 drm/xe: harden adjust_idledly() against divide-by-zero and overflow
- CVE-2026-98918 mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
- CVE-2026-98917 parisc: Increase kernel stack size to 32kb
- CVE-2026-98916 wifi: nl80211: check link is beaconing for color change
- CVE-2026-98915 media: video-i2c: use vb2_video_unregister_device on driver removal
- CVE-2026-98914 drm/amdgpu: cap ATOM command table nesting depth
- CVE-2026-98913 net: thunderx: fix PTP device ref leak in nicvf_probe()
- CVE-2026-98912 ALSA: seq: oss: Reject reads that cannot fit the next event
- CVE-2026-98911 dpaa2-switch: fix the error path in dpaa2_switch_rx()
- CVE-2026-98910 drm/amdkfd: Unwind debug trap enable on copy_to_user failure
- CVE-2026-9891 Use after free in Chrome
- CVE-2026-98909 net: cpsw_new: unregister devlink on port registration failure
- CVE-2026-98908 net: microchip: sparx5: clean up PSFP resources on flower setup failure
- CVE-2026-98907 btrfs: protect sb_write_pointer() with invalidate lock
- CVE-2026-98906 net: lan966x: restore RX state on reload failure
- CVE-2026-98905 drm/amdkfd: Properly acquire queue buffers in CRIU restore
- CVE-2026-98904 mailbox: imx: Use devm_pm_runtime_enable()
- CVE-2026-98903 mailbox: imx: Add a channel shutdown field
- CVE-2026-98902 md/raid5: let stripe batch bm_seq comparison wrap-safe
- CVE-2026-98901 ksmbd: fix lease break and ack state handling
- CVE-2026-98900 xen/gntalloc: validate grant count before allocation
- CVE-2026-9890 Use after free in Chrome
- CVE-2026-98899 netfilter: ipset: mark the rcu locked areas properly
- CVE-2026-98898 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
- CVE-2026-98897 ksmbd: don't hold ci->m_lock while waiting for a lease break ack
- CVE-2026-98896 thunderbolt: Keep the domain reference while processing hotplug
- CVE-2026-98895 net/mlx5: HWS, Handle destroying table that has a miss table
- CVE-2026-98894 drm/amd/ras: reset CPER ring on corrupt entry size
- CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size
- CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
- CVE-2026-98891 wifi: mac80211: validate deauth frame length before reason access
- CVE-2026-98890 wifi: libertas: reject short monitor TX frames
- CVE-2026-9889 Memory corruption in Chrome
- CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing
- CVE-2026-98888 arm64: kprobes: Allow reentering kprobes while single-stepping
- CVE-2026-98887 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
- CVE-2026-98886 drm/gma500: return errors from Oaktrail HDMI I2C reads
- CVE-2026-98885 ima: return error early if file xattr cannot be changed
- CVE-2026-98884 mmc: core: Add validation for host-provided max_segs
- CVE-2026-98883 serial: 8250_port: recognize UPIO_AU
- CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info
- CVE-2026-98881 net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
- CVE-2026-98880 ntfs3: handle set_blocksize failures
- CVE-2026-9888 Use after free in Chrome
- CVE-2026-98879 isofs: handle set_blocksize failures
- CVE-2026-98878 irqchip/gic-v5: Immediately exec priority drop following activate
- CVE-2026-98877 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
- CVE-2026-98876 host1x: bus: Fix missing ops null check in error teardown
- CVE-2026-98875 drm/nouveau/gsp: add SEC2 to GA100 chip table
- CVE-2026-98874 wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect
- CVE-2026-98873 netfilter: nf_conntrack_expect: zero at allocation time
- CVE-2026-98872 freevxfs: don't BUG() on unknown typed-extent type
- CVE-2026-98871 crypto: ccp - Fix possible deadlock in SEV init failure path
- CVE-2026-98870 ksmbd: remove stale channels from all sessions on teardown
- CVE-2026-9887 Use after free in Chrome
- CVE-2026-98869 bpf: Infer zext_dst based on static register liveness analysis
- CVE-2026-98868 dm-pcache: reject a kset that overruns its segment
- CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory
- CVE-2026-98866 sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
- CVE-2026-98865 sched_ext: Don't run ops.dequeue() with a DSQ lock held
- CVE-2026-98864 sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
- CVE-2026-98863 KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
- CVE-2026-98862 audit: fix exe mark UAF in kill_rules()
- CVE-2026-98861 fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
- CVE-2026-98860 HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request