# Vulnerabilities published in 2026


- [CVE-2026-98769](https://insights.sbomify.com/CVE-2026-98769/): usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (not scored)
- [CVE-2026-98768](https://insights.sbomify.com/CVE-2026-98768/): usb: typec: anx7411 - stop the IRQ before destroying the workqueue (not scored)
- [CVE-2026-98767](https://insights.sbomify.com/CVE-2026-98767/): usb: dwc3: gadget: fix IRQ storm on invalid event buffer count (not scored)
- [CVE-2026-98766](https://insights.sbomify.com/CVE-2026-98766/): usb: gadget: aspeed-vhub: cancel wake work on device removal (not scored)
- [CVE-2026-98765](https://insights.sbomify.com/CVE-2026-98765/): USB: gadget: dummy-hcd: Fix wait for outstanding request completions (not scored)
- [CVE-2026-98764](https://insights.sbomify.com/CVE-2026-98764/): usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (not scored)
- [CVE-2026-98763](https://insights.sbomify.com/CVE-2026-98763/): usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (not scored)
- [CVE-2026-98762](https://insights.sbomify.com/CVE-2026-98762/): USB: dwc2: shut down wakeup timer before freeing HCD state (not scored)
- [CVE-2026-98761](https://insights.sbomify.com/CVE-2026-98761/): usb: typec: tcpm: recover after failure to start the frs ams (not scored)
- [CVE-2026-98760](https://insights.sbomify.com/CVE-2026-98760/): usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (not scored)
- [CVE-2026-9876](https://insights.sbomify.com/CVE-2026-9876/): Use after free in Chrome (critical 9.6)
- [CVE-2026-98759](https://insights.sbomify.com/CVE-2026-98759/): usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() (not scored)
- [CVE-2026-98758](https://insights.sbomify.com/CVE-2026-98758/): usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (not scored)
- [CVE-2026-98757](https://insights.sbomify.com/CVE-2026-98757/): usb: cdns3: fix use-after-free in cdns3_gadget_exit() (not scored)
- [CVE-2026-98756](https://insights.sbomify.com/CVE-2026-98756/): usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (not scored)
- [CVE-2026-98755](https://insights.sbomify.com/CVE-2026-98755/): tty: vcc: zero-initialize control packet in vcc_send_ctl() (not scored)
- [CVE-2026-98754](https://insights.sbomify.com/CVE-2026-98754/): tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup (not scored)
- [CVE-2026-98753](https://insights.sbomify.com/CVE-2026-98753/): tty: tty_port: restore TTY_IO_ERROR on activation failure (not scored)
- [CVE-2026-98752](https://insights.sbomify.com/CVE-2026-98752/): tty: port: fix tty_port_tty_vhangup() race (not scored)
- [CVE-2026-98751](https://insights.sbomify.com/CVE-2026-98751/): tty: abort break signalling on hangup (not scored)
- [CVE-2026-98750](https://insights.sbomify.com/CVE-2026-98750/): tty: fix saved termios reset race (not scored)
- [CVE-2026-9875](https://insights.sbomify.com/CVE-2026-9875/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-98749](https://insights.sbomify.com/CVE-2026-98749/): tty: serial: max3100: shut down timer before freeing port (not scored)
- [CVE-2026-98748](https://insights.sbomify.com/CVE-2026-98748/): serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (not scored)
- [CVE-2026-98747](https://insights.sbomify.com/CVE-2026-98747/): serial: core: fix NULL pointer dereference in serial_core_unregister_port() (not scored)
- [CVE-2026-98746](https://insights.sbomify.com/CVE-2026-98746/): serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (not scored)
- [CVE-2026-98745](https://insights.sbomify.com/CVE-2026-98745/): arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems (not scored)
- [CVE-2026-98744](https://insights.sbomify.com/CVE-2026-98744/): ASoC: codecs: max98363: fix uninitialized stream_config->type (not scored)
- [CVE-2026-98743](https://insights.sbomify.com/CVE-2026-98743/): ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (not scored)
- [CVE-2026-98742](https://insights.sbomify.com/CVE-2026-98742/): ALSA: seq: Serialize compat port-info ioctls (not scored)
- [CVE-2026-98741](https://insights.sbomify.com/CVE-2026-98741/): ALSA: ua101: reject mismatched capture/playback packet sizes (not scored)
- [CVE-2026-98740](https://insights.sbomify.com/CVE-2026-98740/): EDAC/altera: Drop __init from ECC setup paths for re-probe safety (not scored)
- [CVE-2026-9874](https://insights.sbomify.com/CVE-2026-9874/): Use after free in Chrome (critical 9.6)
- [CVE-2026-98739](https://insights.sbomify.com/CVE-2026-98739/): Bluetooth: RFCOMM: Fix initial port reference race (not scored)
- [CVE-2026-98738](https://insights.sbomify.com/CVE-2026-98738/): Bluetooth: Serialize SMP remote OOB data access (not scored)
- [CVE-2026-98737](https://insights.sbomify.com/CVE-2026-98737/): Bluetooth: hci_sync: Fix inquiry cache use-after-free (not scored)
- [CVE-2026-98736](https://insights.sbomify.com/CVE-2026-98736/): Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (not scored)
- [CVE-2026-98735](https://insights.sbomify.com/CVE-2026-98735/): Bluetooth: hci_core: Serialize ACL scheduling with channel deletion (not scored)
- [CVE-2026-98734](https://insights.sbomify.com/CVE-2026-98734/): Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown (not scored)
- [CVE-2026-98733](https://insights.sbomify.com/CVE-2026-98733/): Bluetooth: hci_core: Serialize fragmented ISO packet queueing (not scored)
- [CVE-2026-98732](https://insights.sbomify.com/CVE-2026-98732/): Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (not scored)
- [CVE-2026-98731](https://insights.sbomify.com/CVE-2026-98731/): Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() (not scored)
- [CVE-2026-98730](https://insights.sbomify.com/CVE-2026-98730/): Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (not scored)
- [CVE-2026-9873](https://insights.sbomify.com/CVE-2026-9873/): Use after free in Chrome (high 8.8)
- [CVE-2026-98729](https://insights.sbomify.com/CVE-2026-98729/): x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h (not scored)
- [CVE-2026-98728](https://insights.sbomify.com/CVE-2026-98728/): tpm: fix off-by-four bounds check in tpm2_get_random() (not scored)
- [CVE-2026-98727](https://insights.sbomify.com/CVE-2026-98727/): nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known (not scored)
- [CVE-2026-98726](https://insights.sbomify.com/CVE-2026-98726/): nvme-multipath: fix underflow in ANA log bounds checks (not scored)
- [CVE-2026-98725](https://insights.sbomify.com/CVE-2026-98725/): nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (not scored)
- [CVE-2026-98724](https://insights.sbomify.com/CVE-2026-98724/): nvmet: pci-epf: reject too-short SGL segments (not scored)
- [CVE-2026-98723](https://insights.sbomify.com/CVE-2026-98723/): nvmet: copy the hostid into the ctrl before creating PR pc_refs (not scored)
- [CVE-2026-98722](https://insights.sbomify.com/CVE-2026-98722/): mtd: block2mtd: Fix divide error when erase_size is zero (not scored)
- [CVE-2026-98721](https://insights.sbomify.com/CVE-2026-98721/): mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (not scored)
- [CVE-2026-98720](https://insights.sbomify.com/CVE-2026-98720/): KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified (not scored)
- [CVE-2026-9872](https://insights.sbomify.com/CVE-2026-9872/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-98719](https://insights.sbomify.com/CVE-2026-98719/): KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it (not scored)
- [CVE-2026-98718](https://insights.sbomify.com/CVE-2026-98718/): KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state (not scored)
- [CVE-2026-98717](https://insights.sbomify.com/CVE-2026-98717/): KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (not scored)
- [CVE-2026-98716](https://insights.sbomify.com/CVE-2026-98716/): KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted (not scored)
- [CVE-2026-98715](https://insights.sbomify.com/CVE-2026-98715/): KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (not scored)
- [CVE-2026-98714](https://insights.sbomify.com/CVE-2026-98714/): KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded (not scored)
- [CVE-2026-98713](https://insights.sbomify.com/CVE-2026-98713/): KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT (not scored)
- [CVE-2026-98712](https://insights.sbomify.com/CVE-2026-98712/): KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq (not scored)
- [CVE-2026-98711](https://insights.sbomify.com/CVE-2026-98711/): wifi: cw1200: fix TX padding OOB read leaking heap data to device (not scored)
- [CVE-2026-98710](https://insights.sbomify.com/CVE-2026-98710/): wifi: iwlegacy: 3945: free EEPROM data on remove (not scored)
- [CVE-2026-98709](https://insights.sbomify.com/CVE-2026-98709/): wifi: mac80211: count only matching reservations in reserved switch (not scored)
- [CVE-2026-98708](https://insights.sbomify.com/CVE-2026-98708/): wifi: mac80211: keep paired old chanctx alive (not scored)
- [CVE-2026-98707](https://insights.sbomify.com/CVE-2026-98707/): wifi: mac80211: shut down RX BA session timer on teardown (not scored)
- [CVE-2026-98706](https://insights.sbomify.com/CVE-2026-98706/): wifi: mac80211: drain PS delivery work during station teardown (not scored)
- [CVE-2026-98705](https://insights.sbomify.com/CVE-2026-98705/): wifi: mac80211: account proxy paths against the mesh path limit (not scored)
- [CVE-2026-98704](https://insights.sbomify.com/CVE-2026-98704/): wifi: mac80211: keep fallback association elements alive (not scored)
- [CVE-2026-98703](https://insights.sbomify.com/CVE-2026-98703/): wifi: mac80211: minstrel_ht: validate fixed rate index (not scored)
- [CVE-2026-98702](https://insights.sbomify.com/CVE-2026-98702/): wifi: mac80211: reject invalid 320 MHz CSA bandwidth (not scored)
- [CVE-2026-98701](https://insights.sbomify.com/CVE-2026-98701/): wifi: mac80211: release mesh path quota on failed additions (not scored)
- [CVE-2026-98700](https://insights.sbomify.com/CVE-2026-98700/): wifi: mac80211: set info->band for 802.3 encap offload frames (not scored)
- [CVE-2026-98699](https://insights.sbomify.com/CVE-2026-98699/): wifi: mac80211: fix mesh fast xmit path deletion UAF (not scored)
- [CVE-2026-98698](https://insights.sbomify.com/CVE-2026-98698/): wifi: mac80211: handle empty FILS association request payload (not scored)
- [CVE-2026-98697](https://insights.sbomify.com/CVE-2026-98697/): USB: serial: fix dynamic id driver deregistration race (not scored)
- [CVE-2026-98696](https://insights.sbomify.com/CVE-2026-98696/): USB: serial: fix driver deregistration order (not scored)
- [CVE-2026-98695](https://insights.sbomify.com/CVE-2026-98695/): USB: serial: fix ioctl hangup race (not scored)
- [CVE-2026-98694](https://insights.sbomify.com/CVE-2026-98694/): thunderbolt: Fix KASAN reported use-after-free when request is canceled (not scored)
- [CVE-2026-98693](https://insights.sbomify.com/CVE-2026-98693/): thunderbolt: Hold a router reference for each allocated HopID (not scored)
- [CVE-2026-98692](https://insights.sbomify.com/CVE-2026-98692/): thunderbolt: Make the DP tunnel activation callback mandatory (not scored)
- [CVE-2026-98691](https://insights.sbomify.com/CVE-2026-98691/): thunderbolt: Tear down inactive DP tunnels when the domain is stopped (not scored)
- [CVE-2026-98690](https://insights.sbomify.com/CVE-2026-98690/): thunderbolt: Fix domain reference leak when DPRX read is canceled (not scored)
- [CVE-2026-9869](https://insights.sbomify.com/CVE-2026-9869/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-98689](https://insights.sbomify.com/CVE-2026-98689/): thunderbolt: Don't access a DP tunnel after its DPRX read was canceled (not scored)
- [CVE-2026-98688](https://insights.sbomify.com/CVE-2026-98688/): thunderbolt: Fix NULL dereference in tb_remove_work() (not scored)
- [CVE-2026-98687](https://insights.sbomify.com/CVE-2026-98687/): thunderbolt: Reject oversized XDomain properties responses (not scored)
- [CVE-2026-98686](https://insights.sbomify.com/CVE-2026-98686/): smb: client: discard post-EOF pagecache when extending a file via zero range (not scored)
- [CVE-2026-98685](https://insights.sbomify.com/CVE-2026-98685/): smb: client: discard post-EOF pagecache when extending a file via clone range (not scored)
- [CVE-2026-98684](https://insights.sbomify.com/CVE-2026-98684/): smb: client: flush and commit data before querying allocated ranges (not scored)
- [CVE-2026-98683](https://insights.sbomify.com/CVE-2026-98683/): smb: client: flush dirty data before zeroing a range (not scored)
- [CVE-2026-98682](https://insights.sbomify.com/CVE-2026-98682/): smb: client: drain and invalidate before server-side copy/clone (not scored)
- [CVE-2026-98681](https://insights.sbomify.com/CVE-2026-98681/): smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (not scored)
- [CVE-2026-98680](https://insights.sbomify.com/CVE-2026-98680/): iio: accel: kionix-kx022a: Prevent memory leak and fix state (not scored)
- [CVE-2026-98679](https://insights.sbomify.com/CVE-2026-98679/): iio: accel: kxcjk-1013: reject duplicate event disable (not scored)
- [CVE-2026-98678](https://insights.sbomify.com/CVE-2026-98678/): iio: adc: ad4030: fix invalid oversampling_ratio validation (not scored)
- [CVE-2026-98677](https://insights.sbomify.com/CVE-2026-98677/): iio: adc: ad_sigma_delta: fix use-after-free on unbind (not scored)
- [CVE-2026-98676](https://insights.sbomify.com/CVE-2026-98676/): iio: adc: ade9000: fix NULL pointer dereference in clkout registration (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/205/