Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 204 of 1013.
- CVE-2026-9886 Use after free in Chrome
- CVE-2026-98859 HID: multitouch: stop the release timer from being rearmed on remove
- CVE-2026-98858 io_uring: fix task_work add use-after-free with SQPOLL
- CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth
- CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap
- CVE-2026-98855 of/overlay: put property on deadprops only after changeset add succeeds
- CVE-2026-98854 of/overlay: only treat a positive changeset id as registered
- CVE-2026-98853 net: gso: limit recursive IP-in-IP segmentation
- CVE-2026-98852 net: extend IPv6 exthdr detection of tunneled packets
- CVE-2026-98851 netfilter: nft_flow_offload: drop flowtable reference on init error path
- CVE-2026-98850 net/packet: prevent TX_RING byte count overflow
- CVE-2026-9885 Security feature bypass in Chrome
- CVE-2026-98849 pfcp: fix socket lifetime on netdevice registration failure
- CVE-2026-98848 rtc: ac100: Assign .num before accessing .hws
- CVE-2026-98847 rtc: spear: initialize IRQ state before requesting alarm IRQ
- CVE-2026-98846 sctp: check RCV_SHUTDOWN after the sendmsg connect wait
- CVE-2026-98845 tpm: Disable TPM on null key name mismatch
- CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write
- CVE-2026-98843 netfs: zero gaps in read-gaps folio to avoid writing back stale data
- CVE-2026-98842 module: fix lost error code from codetag_load_module()
- CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers
- CVE-2026-98840 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
- CVE-2026-9884 Use after free in Chrome
- CVE-2026-98839 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
- CVE-2026-98838 vt: skip screen update for DEC alignment test on backgroup consoles
- CVE-2026-98837 ALSA: caiaq: unregister the input device when probe fails
- CVE-2026-98836 ALSA: line6: reject oversized playback packets
- CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check
- CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device
- CVE-2026-98833 mtd: core: call _get_device() with the master MTD
- CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()
- CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails
- CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller
- CVE-2026-9883 Use after free in Chrome
- CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow
- CVE-2026-98828 wifi: ath9k: reject short WMI command responses
- CVE-2026-98827 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
- CVE-2026-98826 rtc: ac100: Fix clock provider use-after-free on probe failure
- CVE-2026-98825 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
- CVE-2026-98824 wifi: mac80211: validate TX status rate metadata
- CVE-2026-98823 wifi: cfg80211: preserve hidden-group beacon IE ownership
- CVE-2026-98822 wifi: mac80211: prevent AP VLAN tx from other interfaces
- CVE-2026-98821 block: reject polled dio with user integrity metadata
- CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known
- CVE-2026-9882 Integer overflow in Chrome
- CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths
- CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()
- CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe
- CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding
- CVE-2026-98815 nvme: fix cdev lifetime
- CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads
- CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record
- CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised
- CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path
- CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
- CVE-2026-9881 Use after free in Chrome
- CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
- CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
- CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events
- CVE-2026-98806 octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
- CVE-2026-98805 tipc: prevent GCM nonce reuse on peer key changes
- CVE-2026-98804 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
- CVE-2026-98803 net: stmmac: fix rx Scatter-Gather support
- CVE-2026-98802 seg6: ensure packet data is writable before modifying SRH and IPv6 DA
- CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
- CVE-2026-98800 bpf: Wait for an RCU tasks grace period before freeing trampoline progs
- CVE-2026-9880 Security feature bypass in Chrome
- CVE-2026-98799 bpf: Skip detached progs in trampoline images that are still in use
- CVE-2026-98798 net: bcmgenet: fix NULL dereference in set_coalesce before first open
- CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked
- CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
- CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped
- CVE-2026-98794 ipvs: filter some flags received in the backup server
- CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types
- CVE-2026-98792 netfilter: flowtable: generalize pending status bit
- CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
- CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()
- CVE-2026-9879 Memory corruption in Chrome
- CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace
- CVE-2026-98788 futex: Fix private hash use-after-free on resize
- CVE-2026-98787 bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
- CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation
- CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
- CVE-2026-98784 drm/amdgpu/gfx6: fix firmware leak on teardown
- CVE-2026-98783 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
- CVE-2026-98782 drm/mediatek: Fix ovl adaptor platform device leak
- CVE-2026-98781 drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
- CVE-2026-98780 drm/amdgpu: fix IP instance memory leak on kobject add failure
- CVE-2026-9878 Use after free in Chrome
- CVE-2026-98779 drm/amdgpu: fix ACP MFD device leak on init failure
- CVE-2026-98778 binder: fix is_failure flag for superseded transaction cleanup
- CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
- CVE-2026-98776 binderfs: fix UAF write in binder_add_device
- CVE-2026-98775 nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
- CVE-2026-98774 rust_binder: cancel deferred work items in thread exit
- CVE-2026-98773 USB: cdc-acm: skip URB restart in port_shutdown if disconnected
- CVE-2026-98772 USB: serial: fix port tear down use-after-free
- CVE-2026-98771 usb: storage: sierra_ms: reject short SWoC info transfers
- CVE-2026-98770 usb: gadget: midi2: Fix the jack descriptor array sizes
- CVE-2026-9877 Use after free in Chrome