# Vulnerabilities published in 2026


- [CVE-2026-9886](https://insights.sbomify.com/CVE-2026-9886/): Use after free in Chrome (critical 9.6)
- [CVE-2026-98859](https://insights.sbomify.com/CVE-2026-98859/): HID: multitouch: stop the release timer from being rearmed on remove (not scored)
- [CVE-2026-98858](https://insights.sbomify.com/CVE-2026-98858/): io_uring: fix task_work add use-after-free with SQPOLL (not scored)
- [CVE-2026-98857](https://insights.sbomify.com/CVE-2026-98857/): ipvs: bound LBLCR and LBLC cache growth (not scored)
- [CVE-2026-98856](https://insights.sbomify.com/CVE-2026-98856/): kprobes: Skip disarmed probes when checking optkprobe overlap (not scored)
- [CVE-2026-98855](https://insights.sbomify.com/CVE-2026-98855/): of/overlay: put property on deadprops only after changeset add succeeds (not scored)
- [CVE-2026-98854](https://insights.sbomify.com/CVE-2026-98854/): of/overlay: only treat a positive changeset id as registered (not scored)
- [CVE-2026-98853](https://insights.sbomify.com/CVE-2026-98853/): net: gso: limit recursive IP-in-IP segmentation (not scored)
- [CVE-2026-98852](https://insights.sbomify.com/CVE-2026-98852/): net: extend IPv6 exthdr detection of tunneled packets (not scored)
- [CVE-2026-98851](https://insights.sbomify.com/CVE-2026-98851/): netfilter: nft_flow_offload: drop flowtable reference on init error path (not scored)
- [CVE-2026-98850](https://insights.sbomify.com/CVE-2026-98850/): net/packet: prevent TX_RING byte count overflow (not scored)
- [CVE-2026-9885](https://insights.sbomify.com/CVE-2026-9885/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-98849](https://insights.sbomify.com/CVE-2026-98849/): pfcp: fix socket lifetime on netdevice registration failure (not scored)
- [CVE-2026-98848](https://insights.sbomify.com/CVE-2026-98848/): rtc: ac100: Assign .num before accessing .hws (not scored)
- [CVE-2026-98847](https://insights.sbomify.com/CVE-2026-98847/): rtc: spear: initialize IRQ state before requesting alarm IRQ (not scored)
- [CVE-2026-98846](https://insights.sbomify.com/CVE-2026-98846/): sctp: check RCV_SHUTDOWN after the sendmsg connect wait (not scored)
- [CVE-2026-98845](https://insights.sbomify.com/CVE-2026-98845/): tpm: Disable TPM on null key name mismatch (not scored)
- [CVE-2026-98844](https://insights.sbomify.com/CVE-2026-98844/): netfs: clear post-EOF pagecache when extending a file via write (not scored)
- [CVE-2026-98843](https://insights.sbomify.com/CVE-2026-98843/): netfs: zero gaps in read-gaps folio to avoid writing back stale data (not scored)
- [CVE-2026-98842](https://insights.sbomify.com/CVE-2026-98842/): module: fix lost error code from codetag_load_module() (not scored)
- [CVE-2026-98841](https://insights.sbomify.com/CVE-2026-98841/): virt: vmgenid: set driver_data before registering notification handlers (not scored)
- [CVE-2026-98840](https://insights.sbomify.com/CVE-2026-98840/): vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (not scored)
- [CVE-2026-9884](https://insights.sbomify.com/CVE-2026-9884/): Use after free in Chrome (high 8.8)
- [CVE-2026-98839](https://insights.sbomify.com/CVE-2026-98839/): vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() (not scored)
- [CVE-2026-98838](https://insights.sbomify.com/CVE-2026-98838/): vt: skip screen update for DEC alignment test on backgroup consoles (not scored)
- [CVE-2026-98837](https://insights.sbomify.com/CVE-2026-98837/): ALSA: caiaq: unregister the input device when probe fails (not scored)
- [CVE-2026-98836](https://insights.sbomify.com/CVE-2026-98836/): ALSA: line6: reject oversized playback packets (not scored)
- [CVE-2026-98835](https://insights.sbomify.com/CVE-2026-98835/): iio: accel: kionix-kx022a: Fix array boundary check (not scored)
- [CVE-2026-98834](https://insights.sbomify.com/CVE-2026-98834/): mtd: core: avoid double-free of OTP NVMEM device (not scored)
- [CVE-2026-98833](https://insights.sbomify.com/CVE-2026-98833/): mtd: core: call _get_device() with the master MTD (not scored)
- [CVE-2026-98832](https://insights.sbomify.com/CVE-2026-98832/): blk-cgroup: save IRQ state in blkg_tryget_closest() (not scored)
- [CVE-2026-98831](https://insights.sbomify.com/CVE-2026-98831/): of/overlay: don't leak fragment references when changeset init fails (not scored)
- [CVE-2026-98830](https://insights.sbomify.com/CVE-2026-98830/): wifi: wfx: validate MIB read length before copying to caller (not scored)
- [CVE-2026-9883](https://insights.sbomify.com/CVE-2026-9883/): Use after free in Chrome (high 8.8)
- [CVE-2026-98829](https://insights.sbomify.com/CVE-2026-98829/): wifi: mac80211: drop oversized fragments to avoid extra_len overflow (not scored)
- [CVE-2026-98828](https://insights.sbomify.com/CVE-2026-98828/): wifi: ath9k: reject short WMI command responses (not scored)
- [CVE-2026-98827](https://insights.sbomify.com/CVE-2026-98827/): wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE (not scored)
- [CVE-2026-98826](https://insights.sbomify.com/CVE-2026-98826/): rtc: ac100: Fix clock provider use-after-free on probe failure (not scored)
- [CVE-2026-98825](https://insights.sbomify.com/CVE-2026-98825/): rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (not scored)
- [CVE-2026-98824](https://insights.sbomify.com/CVE-2026-98824/): wifi: mac80211: validate TX status rate metadata (not scored)
- [CVE-2026-98823](https://insights.sbomify.com/CVE-2026-98823/): wifi: cfg80211: preserve hidden-group beacon IE ownership (not scored)
- [CVE-2026-98822](https://insights.sbomify.com/CVE-2026-98822/): wifi: mac80211: prevent AP VLAN tx from other interfaces (not scored)
- [CVE-2026-98821](https://insights.sbomify.com/CVE-2026-98821/): block: reject polled dio with user integrity metadata (not scored)
- [CVE-2026-98820](https://insights.sbomify.com/CVE-2026-98820/): blk-mq: set RQF_USE_SCHED when the operation is known (not scored)
- [CVE-2026-9882](https://insights.sbomify.com/CVE-2026-9882/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-98819](https://insights.sbomify.com/CVE-2026-98819/): Bluetooth: btintel: validate DDC record lengths (not scored)
- [CVE-2026-98818](https://insights.sbomify.com/CVE-2026-98818/): mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() (not scored)
- [CVE-2026-98817](https://insights.sbomify.com/CVE-2026-98817/): ASoC: SDCA: Add better pm_runtime error handling in func probe (not scored)
- [CVE-2026-98816](https://insights.sbomify.com/CVE-2026-98816/): bpf: Fix overflow of jump offset in constant blinding (not scored)
- [CVE-2026-98815](https://insights.sbomify.com/CVE-2026-98815/): nvme: fix cdev lifetime (not scored)
- [CVE-2026-98814](https://insights.sbomify.com/CVE-2026-98814/): nvme: fix command effects log lifetime for multipath heads (not scored)
- [CVE-2026-98813](https://insights.sbomify.com/CVE-2026-98813/): bpf: Hold map BTF for the memory allocator destructor record (not scored)
- [CVE-2026-98812](https://insights.sbomify.com/CVE-2026-98812/): net/mctp: publish the mctp_dev only after it is initialised (not scored)
- [CVE-2026-98811](https://insights.sbomify.com/CVE-2026-98811/): net/sched: cls_api: reclaim an empty proto on the error path (not scored)
- [CVE-2026-98810](https://insights.sbomify.com/CVE-2026-98810/): wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (not scored)
- [CVE-2026-9881](https://insights.sbomify.com/CVE-2026-9881/): Use after free in Chrome (critical 9.0)
- [CVE-2026-98809](https://insights.sbomify.com/CVE-2026-98809/): Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister (not scored)
- [CVE-2026-98808](https://insights.sbomify.com/CVE-2026-98808/): net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (not scored)
- [CVE-2026-98807](https://insights.sbomify.com/CVE-2026-98807/): net/mlx5: Fix slab-out-of-bounds when handling team device events (not scored)
- [CVE-2026-98806](https://insights.sbomify.com/CVE-2026-98806/): octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (not scored)
- [CVE-2026-98805](https://insights.sbomify.com/CVE-2026-98805/): tipc: prevent GCM nonce reuse on peer key changes (not scored)
- [CVE-2026-98804](https://insights.sbomify.com/CVE-2026-98804/): net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() (not scored)
- [CVE-2026-98803](https://insights.sbomify.com/CVE-2026-98803/): net: stmmac: fix rx Scatter-Gather support (not scored)
- [CVE-2026-98802](https://insights.sbomify.com/CVE-2026-98802/): seg6: ensure packet data is writable before modifying SRH and IPv6 DA (not scored)
- [CVE-2026-98801](https://insights.sbomify.com/CVE-2026-98801/): net: restrict SO_RESERVE_MEM to TCP sockets and cap max value (not scored)
- [CVE-2026-98800](https://insights.sbomify.com/CVE-2026-98800/): bpf: Wait for an RCU tasks grace period before freeing trampoline progs (not scored)
- [CVE-2026-9880](https://insights.sbomify.com/CVE-2026-9880/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-98799](https://insights.sbomify.com/CVE-2026-98799/): bpf: Skip detached progs in trampoline images that are still in use (not scored)
- [CVE-2026-98798](https://insights.sbomify.com/CVE-2026-98798/): net: bcmgenet: fix NULL dereference in set_coalesce before first open (not scored)
- [CVE-2026-98797](https://insights.sbomify.com/CVE-2026-98797/): net: cap skb->queue_mapping when the tx queue is picked (not scored)
- [CVE-2026-98796](https://insights.sbomify.com/CVE-2026-98796/): net: ethernet: mtk_eth_soc: allocate dummy netdev sooner (not scored)
- [CVE-2026-98795](https://insights.sbomify.com/CVE-2026-98795/): net: sparx5: skip ptp deinit if init was skipped (not scored)
- [CVE-2026-98794](https://insights.sbomify.com/CVE-2026-98794/): ipvs: filter some flags received in the backup server (not scored)
- [CVE-2026-98793](https://insights.sbomify.com/CVE-2026-98793/): netfilter: bpf: reject invalid NAT manipulation types (not scored)
- [CVE-2026-98792](https://insights.sbomify.com/CVE-2026-98792/): netfilter: flowtable: generalize pending status bit (not scored)
- [CVE-2026-98791](https://insights.sbomify.com/CVE-2026-98791/): net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference (not scored)
- [CVE-2026-98790](https://insights.sbomify.com/CVE-2026-98790/): perf: Fix race between perf_event_exit_task() and perf_pending_task() (not scored)
- [CVE-2026-9879](https://insights.sbomify.com/CVE-2026-9879/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-98789](https://insights.sbomify.com/CVE-2026-98789/): bpf: Fix objects stuck in free_by_rcu_ttrace (not scored)
- [CVE-2026-98788](https://insights.sbomify.com/CVE-2026-98788/): futex: Fix private hash use-after-free on resize (not scored)
- [CVE-2026-98787](https://insights.sbomify.com/CVE-2026-98787/): bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() (not scored)
- [CVE-2026-98786](https://insights.sbomify.com/CVE-2026-98786/): drm/amd/display: guard dc_sink dereferences in MST mode validation (not scored)
- [CVE-2026-98785](https://insights.sbomify.com/CVE-2026-98785/): drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (not scored)
- [CVE-2026-98784](https://insights.sbomify.com/CVE-2026-98784/): drm/amdgpu/gfx6: fix firmware leak on teardown (not scored)
- [CVE-2026-98783](https://insights.sbomify.com/CVE-2026-98783/): drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (not scored)
- [CVE-2026-98782](https://insights.sbomify.com/CVE-2026-98782/): drm/mediatek: Fix ovl adaptor platform device leak (not scored)
- [CVE-2026-98781](https://insights.sbomify.com/CVE-2026-98781/): drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (not scored)
- [CVE-2026-98780](https://insights.sbomify.com/CVE-2026-98780/): drm/amdgpu: fix IP instance memory leak on kobject add failure (not scored)
- [CVE-2026-9878](https://insights.sbomify.com/CVE-2026-9878/): Use after free in Chrome (high 8.8)
- [CVE-2026-98779](https://insights.sbomify.com/CVE-2026-98779/): drm/amdgpu: fix ACP MFD device leak on init failure (not scored)
- [CVE-2026-98778](https://insights.sbomify.com/CVE-2026-98778/): binder: fix is_failure flag for superseded transaction cleanup (not scored)
- [CVE-2026-98777](https://insights.sbomify.com/CVE-2026-98777/): binder: fix leaked fd fixups on TF_UPDATE_TXN supersede (not scored)
- [CVE-2026-98776](https://insights.sbomify.com/CVE-2026-98776/): binderfs: fix UAF write in binder_add_device (not scored)
- [CVE-2026-98775](https://insights.sbomify.com/CVE-2026-98775/): nitro_enclaves: fix use-after-free on SLOT_ALLOC failure (not scored)
- [CVE-2026-98774](https://insights.sbomify.com/CVE-2026-98774/): rust_binder: cancel deferred work items in thread exit (not scored)
- [CVE-2026-98773](https://insights.sbomify.com/CVE-2026-98773/): USB: cdc-acm: skip URB restart in port_shutdown if disconnected (not scored)
- [CVE-2026-98772](https://insights.sbomify.com/CVE-2026-98772/): USB: serial: fix port tear down use-after-free (not scored)
- [CVE-2026-98771](https://insights.sbomify.com/CVE-2026-98771/): usb: storage: sierra_ms: reject short SWoC info transfers (not scored)
- [CVE-2026-98770](https://insights.sbomify.com/CVE-2026-98770/): usb: gadget: midi2: Fix the jack descriptor array sizes (not scored)
- [CVE-2026-9877](https://insights.sbomify.com/CVE-2026-9877/): Use after free in Chrome (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/204/