Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 205 of 1013.
- CVE-2026-98769 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
- CVE-2026-98768 usb: typec: anx7411 - stop the IRQ before destroying the workqueue
- CVE-2026-98767 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- CVE-2026-98766 usb: gadget: aspeed-vhub: cancel wake work on device removal
- CVE-2026-98765 USB: gadget: dummy-hcd: Fix wait for outstanding request completions
- CVE-2026-98764 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
- CVE-2026-98763 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
- CVE-2026-98762 USB: dwc2: shut down wakeup timer before freeing HCD state
- CVE-2026-98761 usb: typec: tcpm: recover after failure to start the frs ams
- CVE-2026-98760 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
- CVE-2026-9876 Use after free in Chrome
- CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
- CVE-2026-98758 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
- CVE-2026-98757 usb: cdns3: fix use-after-free in cdns3_gadget_exit()
- CVE-2026-98756 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
- CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()
- CVE-2026-98754 tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
- CVE-2026-98753 tty: tty_port: restore TTY_IO_ERROR on activation failure
- CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race
- CVE-2026-98751 tty: abort break signalling on hangup
- CVE-2026-98750 tty: fix saved termios reset race
- CVE-2026-9875 Memory corruption in Chrome
- CVE-2026-98749 tty: serial: max3100: shut down timer before freeing port
- CVE-2026-98748 serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
- CVE-2026-98747 serial: core: fix NULL pointer dereference in serial_core_unregister_port()
- CVE-2026-98746 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
- CVE-2026-98745 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
- CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type
- CVE-2026-98743 ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
- CVE-2026-98742 ALSA: seq: Serialize compat port-info ioctls
- CVE-2026-98741 ALSA: ua101: reject mismatched capture/playback packet sizes
- CVE-2026-98740 EDAC/altera: Drop __init from ECC setup paths for re-probe safety
- CVE-2026-9874 Use after free in Chrome
- CVE-2026-98739 Bluetooth: RFCOMM: Fix initial port reference race
- CVE-2026-98738 Bluetooth: Serialize SMP remote OOB data access
- CVE-2026-98737 Bluetooth: hci_sync: Fix inquiry cache use-after-free
- CVE-2026-98736 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
- CVE-2026-98735 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
- CVE-2026-98734 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
- CVE-2026-98733 Bluetooth: hci_core: Serialize fragmented ISO packet queueing
- CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
- CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- CVE-2026-98730 Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
- CVE-2026-9873 Use after free in Chrome
- CVE-2026-98729 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
- CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()
- CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
- CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks
- CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
- CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments
- CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs
- CVE-2026-98722 mtd: block2mtd: Fix divide error when erase_size is zero
- CVE-2026-98721 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
- CVE-2026-98720 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
- CVE-2026-9872 Memory corruption in Chrome
- CVE-2026-98719 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
- CVE-2026-98718 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
- CVE-2026-98717 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
- CVE-2026-98716 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
- CVE-2026-98715 KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
- CVE-2026-98714 KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
- CVE-2026-98713 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
- CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device
- CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove
- CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch
- CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive
- CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown
- CVE-2026-98706 wifi: mac80211: drain PS delivery work during station teardown
- CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit
- CVE-2026-98704 wifi: mac80211: keep fallback association elements alive
- CVE-2026-98703 wifi: mac80211: minstrel_ht: validate fixed rate index
- CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth
- CVE-2026-98701 wifi: mac80211: release mesh path quota on failed additions
- CVE-2026-98700 wifi: mac80211: set info->band for 802.3 encap offload frames
- CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF
- CVE-2026-98698 wifi: mac80211: handle empty FILS association request payload
- CVE-2026-98697 USB: serial: fix dynamic id driver deregistration race
- CVE-2026-98696 USB: serial: fix driver deregistration order
- CVE-2026-98695 USB: serial: fix ioctl hangup race
- CVE-2026-98694 thunderbolt: Fix KASAN reported use-after-free when request is canceled
- CVE-2026-98693 thunderbolt: Hold a router reference for each allocated HopID
- CVE-2026-98692 thunderbolt: Make the DP tunnel activation callback mandatory
- CVE-2026-98691 thunderbolt: Tear down inactive DP tunnels when the domain is stopped
- CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled
- CVE-2026-9869 Memory corruption in Totolink
- CVE-2026-98689 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
- CVE-2026-98688 thunderbolt: Fix NULL dereference in tb_remove_work()
- CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses
- CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range
- CVE-2026-98685 smb: client: discard post-EOF pagecache when extending a file via clone range
- CVE-2026-98684 smb: client: flush and commit data before querying allocated ranges
- CVE-2026-98683 smb: client: flush dirty data before zeroing a range
- CVE-2026-98682 smb: client: drain and invalidate before server-side copy/clone
- CVE-2026-98681 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
- CVE-2026-98680 iio: accel: kionix-kx022a: Prevent memory leak and fix state
- CVE-2026-98679 iio: accel: kxcjk-1013: reject duplicate event disable
- CVE-2026-98678 iio: adc: ad4030: fix invalid oversampling_ratio validation
- CVE-2026-98677 iio: adc: ad_sigma_delta: fix use-after-free on unbind
- CVE-2026-98676 iio: adc: ade9000: fix NULL pointer dereference in clkout registration