Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 206 of 1013.
- CVE-2026-98675 iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
- CVE-2026-98674 iio: adc: adi-axi-adc: Initialize state mutex
- CVE-2026-98673 iio: adc: pac1934: check ACPI label duplication
- CVE-2026-98672 iio: adc: stm32-adc: fix possible division by zero in processed channel
- CVE-2026-98671 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
- CVE-2026-98670 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
- CVE-2026-98669 iio: buffer: serialize buffer teardown with mode claims
- CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
- CVE-2026-98667 iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data
- CVE-2026-98666 iio: gyro: adis16136: fix unprotected debugfs reads
- CVE-2026-98665 iio: health: max30102: fix NULL dereference in interrupt handler
- CVE-2026-98664 iio: imu: adis16400: fix unprotected debugfs reads
- CVE-2026-98663 iio: imu: adis16480: fix unprotected debugfs reads
- CVE-2026-98662 iio: light: gp2ap020a00f: drain irq_work after free_irq
- CVE-2026-98661 iio: light: rohm-bu27034: Fix infinite delay on error
- CVE-2026-98660 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
- CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails
- CVE-2026-98658 iio: proximity: aw96103: validate firmware data length
- CVE-2026-98657 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
- CVE-2026-98656 iio: trigger: cancel reenable_work before freeing trigger
- CVE-2026-98655 perf: Require kernel access for text poke events
- CVE-2026-98653 KVM: s390: Fix _gaccess_shadow_fault()
- CVE-2026-98652 KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
- CVE-2026-98651 KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
- CVE-2026-98650 KVM: s390: Fix potential races in dat skey functions
- CVE-2026-98649 KVM: s390: Fix race in _destroy_pages_crste()
- CVE-2026-98648 s390/uv: Prevent potential out-of-bounds read
- CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk()
- CVE-2026-98646 tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
- CVE-2026-98645 HID: winwing: fix use-after-free in force feedback teardown
- CVE-2026-98644 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
- CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops
- CVE-2026-98642 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
- CVE-2026-98641 bpf, arm64: set up the frame pointer for the exception callback
- CVE-2026-98640 HID: amd_sfh: Validate PCI BAR size before mapping
- CVE-2026-9864 Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
- CVE-2026-98639 KVM: riscv: Fix NACL hfence entry update order
- CVE-2026-98638 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
- CVE-2026-98637 KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
- CVE-2026-98636 squashfs: Add dictionary size range check to prevent shift-out-of-bounds
- CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report
- CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones
- CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
- CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
- CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup
- CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup
- CVE-2026-9863 Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
- CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing
- CVE-2026-98628 bpf: Make post-verification instruction rewrites killable
- CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe()
- CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions
- CVE-2026-98625 netfilter: flowtable: publish HW_DEAD after worker is done
- CVE-2026-98624 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
- CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
- CVE-2026-98622 net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
- CVE-2026-98621 net: gue: reject invalid REMCSUM offsets
- CVE-2026-98620 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
- CVE-2026-9862 Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
- CVE-2026-98619 net: ethtool: keep rtnl_lock for the ioctl self test
- CVE-2026-98618 eth: fbnic: Handle maximum standalone channels
- CVE-2026-98617 eth: fbnic: use the Rx queue napi pointer to find the napi vector
- CVE-2026-98616 eth: fbnic: reset num_napi when the napi vectors are freed
- CVE-2026-98615 eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
- CVE-2026-98614 sctp: avoid livelock while updating retransmit path
- CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots
- CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()
- CVE-2026-98611 bpf: Check params size before reading reserved fields
- CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
- CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails
- CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
- CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
- CVE-2026-98606 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
- CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
- CVE-2026-98604 ovpn: replace bind when learning local endpoint
- CVE-2026-98603 ovpn: replace bind when clearing stale local source
- CVE-2026-98602 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
- CVE-2026-98601 Bluetooth: btintel_pcie: validate device-supplied DMA indices
- CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
- CVE-2026-9860 Code injection in Offload, AI & Optimize with Cloudflare Images
- CVE-2026-98599 bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
- CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.
- CVE-2026-98597 net: usb: sr9700: include receive overhead in the length check
- CVE-2026-98596 ipv6: Fix dst leak for uncached routes.
- CVE-2026-98595 udp: remove a disconnected socket from the 4-tuple hash table
- CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure
- CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()
- CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure
- CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs
- CVE-2026-98590 bpf: Fix bpf_sock context code generation
- CVE-2026-9859 Missing authorization in Mattermost
- CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs
- CVE-2026-98588 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
- CVE-2026-98587 firewire: cdev: fix back-transition for iso_resource_auto client resource
- CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers
- CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes
- CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()
- CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull
- CVE-2026-98582 nfc: st21nfca: validate received frame size
- CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
- CVE-2026-98580 nfc: llcp: Fix race condition in accept_queue lifecycle