# Vulnerabilities published in 2026


- [CVE-2026-98951](https://insights.sbomify.com/CVE-2026-98951/): riscv: ptrace: Zero-initialize regset buffers before copyin (not scored)
- [CVE-2026-98950](https://insights.sbomify.com/CVE-2026-98950/): flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() (not scored)
- [CVE-2026-9895](https://insights.sbomify.com/CVE-2026-9895/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-98949](https://insights.sbomify.com/CVE-2026-98949/): drm/imagination: Fix reference and vm_bo handling in remap() (not scored)
- [CVE-2026-98948](https://insights.sbomify.com/CVE-2026-98948/): mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() (not scored)
- [CVE-2026-98947](https://insights.sbomify.com/CVE-2026-98947/): vsock: Fix memory leak in vmci_transport_recv_dgram_cb() (not scored)
- [CVE-2026-98946](https://insights.sbomify.com/CVE-2026-98946/): drm/vc4: Disable the V3D interrupt across runtime suspend (not scored)
- [CVE-2026-98945](https://insights.sbomify.com/CVE-2026-98945/): HID: steam: Rearrange teardown sequence (high 7.8)
- [CVE-2026-98944](https://insights.sbomify.com/CVE-2026-98944/): HID: steam: Refactor registration (high 7.8)
- [CVE-2026-98942](https://insights.sbomify.com/CVE-2026-98942/): sched_ext: Build the cid tables privately and publish them with RCU (not scored)
- [CVE-2026-98941](https://insights.sbomify.com/CVE-2026-98941/): ext4: don't enable large folios on encrypted inodes (high 7.0)
- [CVE-2026-98940](https://insights.sbomify.com/CVE-2026-98940/): ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (not scored)
- [CVE-2026-9894](https://insights.sbomify.com/CVE-2026-9894/): Use after free in Chrome (high 8.3)
- [CVE-2026-98939](https://insights.sbomify.com/CVE-2026-98939/): x86/mm: Drop unnecessary PMD page copy when freeing (not scored)
- [CVE-2026-98938](https://insights.sbomify.com/CVE-2026-98938/): rust: irq: pass RegistrationInner as cookie to request_irq (not scored)
- [CVE-2026-98937](https://insights.sbomify.com/CVE-2026-98937/): perf/core: Check kernel access when kernel callchains are requested (not scored)
- [CVE-2026-98936](https://insights.sbomify.com/CVE-2026-98936/): wifi: ath11k: reset ar->num_stations on hardware start (not scored)
- [CVE-2026-98935](https://insights.sbomify.com/CVE-2026-98935/): rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (not scored)
- [CVE-2026-98934](https://insights.sbomify.com/CVE-2026-98934/): ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() (not scored)
- [CVE-2026-98933](https://insights.sbomify.com/CVE-2026-98933/): usb: hub: use shorter 120ms post resume hold for SS root hubs (not scored)
- [CVE-2026-98932](https://insights.sbomify.com/CVE-2026-98932/): EDAC/altera: Fix use-after-free in error paths (high 7.4)
- [CVE-2026-98931](https://insights.sbomify.com/CVE-2026-98931/): mtd: spinand: fix NULL pointer dereference with no ECC engine (not scored)
- [CVE-2026-98930](https://insights.sbomify.com/CVE-2026-98930/): KVM: s390: Fix IRQ injection with SIGP Stop and Store Status (not scored)
- [CVE-2026-9893](https://insights.sbomify.com/CVE-2026-9893/): Use after free in Chrome (high 8.3)
- [CVE-2026-98929](https://insights.sbomify.com/CVE-2026-98929/): macsec: initialize SecY before registering the netdevice (not scored)
- [CVE-2026-98928](https://insights.sbomify.com/CVE-2026-98928/): KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 (not scored)
- [CVE-2026-98927](https://insights.sbomify.com/CVE-2026-98927/): KVM: arm64: nv: Fix life cycle of the nested_mmus array (high 7.0)
- [CVE-2026-98926](https://insights.sbomify.com/CVE-2026-98926/): drm/amd/display: Remove sink usage from DPMS (not scored)
- [CVE-2026-98925](https://insights.sbomify.com/CVE-2026-98925/): bpf, sockmap: Fix self-redirect copied_seq double-counting (not scored)
- [CVE-2026-98924](https://insights.sbomify.com/CVE-2026-98924/): fs: avoid repeated scans in evict_inodes() (not scored)
- [CVE-2026-98923](https://insights.sbomify.com/CVE-2026-98923/): arm64: io: Reject non-user protection in ioremap_prot() (not scored)
- [CVE-2026-98922](https://insights.sbomify.com/CVE-2026-98922/): net: emac: move setting of netops to fix crash (not scored)
- [CVE-2026-98921](https://insights.sbomify.com/CVE-2026-98921/): ovl: fix UAF in ovl_do_mkdir() debug print (not scored)
- [CVE-2026-98920](https://insights.sbomify.com/CVE-2026-98920/): netfs: Fix missing alloc tagging of direct mempool allocations (not scored)
- [CVE-2026-9892](https://insights.sbomify.com/CVE-2026-9892/): Privilege escalation in Chrome (high 8.3)
- [CVE-2026-98919](https://insights.sbomify.com/CVE-2026-98919/): drm/xe: harden adjust_idledly() against divide-by-zero and overflow (not scored)
- [CVE-2026-98918](https://insights.sbomify.com/CVE-2026-98918/): mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() (not scored)
- [CVE-2026-98917](https://insights.sbomify.com/CVE-2026-98917/): parisc: Increase kernel stack size to 32kb (not scored)
- [CVE-2026-98916](https://insights.sbomify.com/CVE-2026-98916/): wifi: nl80211: check link is beaconing for color change (not scored)
- [CVE-2026-98915](https://insights.sbomify.com/CVE-2026-98915/): media: video-i2c: use vb2_video_unregister_device on driver removal (not scored)
- [CVE-2026-98914](https://insights.sbomify.com/CVE-2026-98914/): drm/amdgpu: cap ATOM command table nesting depth (not scored)
- [CVE-2026-98913](https://insights.sbomify.com/CVE-2026-98913/): net: thunderx: fix PTP device ref leak in nicvf_probe() (not scored)
- [CVE-2026-98912](https://insights.sbomify.com/CVE-2026-98912/): ALSA: seq: oss: Reject reads that cannot fit the next event (not scored)
- [CVE-2026-98911](https://insights.sbomify.com/CVE-2026-98911/): dpaa2-switch: fix the error path in dpaa2_switch_rx() (high 7.5)
- [CVE-2026-98910](https://insights.sbomify.com/CVE-2026-98910/): drm/amdkfd: Unwind debug trap enable on copy_to_user failure (not scored)
- [CVE-2026-9891](https://insights.sbomify.com/CVE-2026-9891/): Use after free in Chrome (critical 9.0)
- [CVE-2026-98909](https://insights.sbomify.com/CVE-2026-98909/): net: cpsw_new: unregister devlink on port registration failure (not scored)
- [CVE-2026-98908](https://insights.sbomify.com/CVE-2026-98908/): net: microchip: sparx5: clean up PSFP resources on flower setup failure (not scored)
- [CVE-2026-98907](https://insights.sbomify.com/CVE-2026-98907/): btrfs: protect sb_write_pointer() with invalidate lock (not scored)
- [CVE-2026-98906](https://insights.sbomify.com/CVE-2026-98906/): net: lan966x: restore RX state on reload failure (not scored)
- [CVE-2026-98905](https://insights.sbomify.com/CVE-2026-98905/): drm/amdkfd: Properly acquire queue buffers in CRIU restore (not scored)
- [CVE-2026-98904](https://insights.sbomify.com/CVE-2026-98904/): mailbox: imx: Use devm_pm_runtime_enable() (not scored)
- [CVE-2026-98903](https://insights.sbomify.com/CVE-2026-98903/): mailbox: imx: Add a channel shutdown field (not scored)
- [CVE-2026-98902](https://insights.sbomify.com/CVE-2026-98902/): md/raid5: let stripe batch bm_seq comparison wrap-safe (not scored)
- [CVE-2026-98901](https://insights.sbomify.com/CVE-2026-98901/): ksmbd: fix lease break and ack state handling (not scored)
- [CVE-2026-98900](https://insights.sbomify.com/CVE-2026-98900/): xen/gntalloc: validate grant count before allocation (not scored)
- [CVE-2026-9890](https://insights.sbomify.com/CVE-2026-9890/): Use after free in Chrome (high 8.3)
- [CVE-2026-98899](https://insights.sbomify.com/CVE-2026-98899/): netfilter: ipset: mark the rcu locked areas properly (high 7.8)
- [CVE-2026-98898](https://insights.sbomify.com/CVE-2026-98898/): drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (not scored)
- [CVE-2026-98897](https://insights.sbomify.com/CVE-2026-98897/): ksmbd: don't hold ci->m_lock while waiting for a lease break ack (not scored)
- [CVE-2026-98896](https://insights.sbomify.com/CVE-2026-98896/): thunderbolt: Keep the domain reference while processing hotplug (not scored)
- [CVE-2026-98895](https://insights.sbomify.com/CVE-2026-98895/): net/mlx5: HWS, Handle destroying table that has a miss table (high 7.0)
- [CVE-2026-98894](https://insights.sbomify.com/CVE-2026-98894/): drm/amd/ras: reset CPER ring on corrupt entry size (not scored)
- [CVE-2026-98893](https://insights.sbomify.com/CVE-2026-98893/): firmware: arm_scmi: Validate SENSOR_UPDATE payload size (not scored)
- [CVE-2026-98892](https://insights.sbomify.com/CVE-2026-98892/): firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (not scored)
- [CVE-2026-98891](https://insights.sbomify.com/CVE-2026-98891/): wifi: mac80211: validate deauth frame length before reason access (not scored)
- [CVE-2026-98890](https://insights.sbomify.com/CVE-2026-98890/): wifi: libertas: reject short monitor TX frames (not scored)
- [CVE-2026-9889](https://insights.sbomify.com/CVE-2026-9889/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-98889](https://insights.sbomify.com/CVE-2026-98889/): wifi: iwlwifi: mvm: fix sched scan IE sizing (high 7.8)
- [CVE-2026-98888](https://insights.sbomify.com/CVE-2026-98888/): arm64: kprobes: Allow reentering kprobes while single-stepping (not scored)
- [CVE-2026-98887](https://insights.sbomify.com/CVE-2026-98887/): wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO (not scored)
- [CVE-2026-98886](https://insights.sbomify.com/CVE-2026-98886/): drm/gma500: return errors from Oaktrail HDMI I2C reads (not scored)
- [CVE-2026-98885](https://insights.sbomify.com/CVE-2026-98885/): ima: return error early if file xattr cannot be changed (not scored)
- [CVE-2026-98884](https://insights.sbomify.com/CVE-2026-98884/): mmc: core: Add validation for host-provided max_segs (not scored)
- [CVE-2026-98883](https://insights.sbomify.com/CVE-2026-98883/): serial: 8250_port: recognize UPIO_AU (not scored)
- [CVE-2026-98882](https://insights.sbomify.com/CVE-2026-98882/): media: chips-media: wave5: Add range checks for dec_output_info (not scored)
- [CVE-2026-98881](https://insights.sbomify.com/CVE-2026-98881/): net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() (not scored)
- [CVE-2026-98880](https://insights.sbomify.com/CVE-2026-98880/): ntfs3: handle set_blocksize failures (not scored)
- [CVE-2026-9888](https://insights.sbomify.com/CVE-2026-9888/): Use after free in Chrome (high 8.3)
- [CVE-2026-98879](https://insights.sbomify.com/CVE-2026-98879/): isofs: handle set_blocksize failures (not scored)
- [CVE-2026-98878](https://insights.sbomify.com/CVE-2026-98878/): irqchip/gic-v5: Immediately exec priority drop following activate (not scored)
- [CVE-2026-98877](https://insights.sbomify.com/CVE-2026-98877/): irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (not scored)
- [CVE-2026-98876](https://insights.sbomify.com/CVE-2026-98876/): host1x: bus: Fix missing ops null check in error teardown (not scored)
- [CVE-2026-98875](https://insights.sbomify.com/CVE-2026-98875/): drm/nouveau/gsp: add SEC2 to GA100 chip table (not scored)
- [CVE-2026-98874](https://insights.sbomify.com/CVE-2026-98874/): wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect (not scored)
- [CVE-2026-98873](https://insights.sbomify.com/CVE-2026-98873/): netfilter: nf_conntrack_expect: zero at allocation time (not scored)
- [CVE-2026-98872](https://insights.sbomify.com/CVE-2026-98872/): freevxfs: don't BUG() on unknown typed-extent type (not scored)
- [CVE-2026-98871](https://insights.sbomify.com/CVE-2026-98871/): crypto: ccp - Fix possible deadlock in SEV init failure path (not scored)
- [CVE-2026-98870](https://insights.sbomify.com/CVE-2026-98870/): ksmbd: remove stale channels from all sessions on teardown (high 8.8)
- [CVE-2026-9887](https://insights.sbomify.com/CVE-2026-9887/): Use after free in Chrome (high 7.8)
- [CVE-2026-98869](https://insights.sbomify.com/CVE-2026-98869/): bpf: Infer zext_dst based on static register liveness analysis (high 7.8)
- [CVE-2026-98868](https://insights.sbomify.com/CVE-2026-98868/): dm-pcache: reject a kset that overruns its segment (not scored)
- [CVE-2026-98867](https://insights.sbomify.com/CVE-2026-98867/): dm-pcache: bound the logical key offset from persistent memory (not scored)
- [CVE-2026-98866](https://insights.sbomify.com/CVE-2026-98866/): sched/cache: Introduce task_struct->sched_cache_grp to fix UAF (not scored)
- [CVE-2026-98865](https://insights.sbomify.com/CVE-2026-98865/): sched_ext: Don't run ops.dequeue() with a DSQ lock held (not scored)
- [CVE-2026-98864](https://insights.sbomify.com/CVE-2026-98864/): sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task (not scored)
- [CVE-2026-98863](https://insights.sbomify.com/CVE-2026-98863/): KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (not scored)
- [CVE-2026-98862](https://insights.sbomify.com/CVE-2026-98862/): audit: fix exe mark UAF in kill_rules() (not scored)
- [CVE-2026-98861](https://insights.sbomify.com/CVE-2026-98861/): fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() (not scored)
- [CVE-2026-98860](https://insights.sbomify.com/CVE-2026-98860/): HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/203/